What is the CVSS score of CVE-2026-9253?

CVE-2026-9253 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of WP Cost Estimation are affected by CVE-2026-9253?

The Loopus WP Cost Estimation & Payment Forms Builder plugin (affecting WordPress sites through version 10.5.97) contains a stored cross-site scripting vulnerability that allows unauthenticated…

How to fix or mitigate CVE-2026-9253?

Within 24 hours: audit all WordPress instances for WP Cost Estimation & Payment Forms Builder (Loopus) plugin; immediately disable the plugin and quarantine any affected form submission data. Within 7 days: obtain patch status from vendor; review access logs and database records for malicious 'customerInfos' parameter injection; scan cached pages for injected JavaScript. Within 30 days: implement WAF rules blocking malicious payloads to 'customerInfos' parameter, enforce Content Security Policy headers to block inline JavaScript, and upgrade to a patched version once released or migrate to an alternative form builder.

WP Cost Estimation CVE-2026-9253

EUVD-2026-42579 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-09 Wordfence

GHSA-vm5v-xgw5-w82m

WordPress XSS Wp Cost Estimation Payment Forms Builder Loopus

7.2

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

7.2 HIGH

Unauthenticated network-reachable stored XSS (AV:N/AC:L/PR:N); scope changes into victims' browser context (S:C) with limited confidentiality/integrity via scripting and no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 12:02 vuln.today

CVE Published

Jul 09, 2026 - 11:27 cve.org

HIGH 7.2

DescriptionCVE.org

The WP Cost Estimation & Payment Forms Builder (E&P Forms) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customerInfos' parameter in all versions up to, and including, 10.5.97 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored cross-site scripting in the WP Cost Estimation & Payment Forms Builder (E&P Forms) WordPress plugin (Loopus) affects all versions through 10.5.97 and lets unauthenticated attackers persist arbitrary JavaScript via the 'customerInfos' parameter that fires when any user later views the injected page. Reported by Wordfence with a CVSS 3.1 base score of 7.2 (scope-changed), this is a persistent, no-authentication injection primitive rather than a reflected one. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is not confirmed in the wild.

Technical ContextAI

The affected component is a commercial WordPress form-builder plugin (CPE cpe:2.3:a:loopus:wp_cost_estimation_&_payment_forms_builder) used to construct cost-estimation and payment forms. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): the 'customerInfos' parameter, which carries customer-supplied form data, is neither sufficiently sanitized on input nor escaped on output. Because the tainted value is stored and later rendered into pages served to other visitors and administrators, the payload is executed in the security context of the WordPress site (the DOM of the vulnerable page), enabling classic stored-XSS actions such as session/cookie theft, admin action forgery, and content manipulation.

RemediationAI

No vendor-released patch identified at time of analysis; the input names 10.5.97 as vulnerable but does not confirm a fixed release, so monitor the vendor page (https://www.loopus-plugins.com/plugins/wp-cost-estimation-payments-forms) and the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/2bf0832c-13ed-4e53-9847-d5d2110eb3f8?source=cve) and upgrade to the first release above 10.5.97 as soon as it is published. Until a patched version is available, apply compensating controls: deploy a WAF/virtual-patch rule (e.g. Wordfence) to filter script payloads in the 'customerInfos' parameter, restrict or disable public submission of the affected form if business needs allow (this blocks legitimate customer submissions), and add a restrictive Content-Security-Policy that disallows inline script to blunt payload execution (may break inline scripts used by the theme or other plugins). Review existing stored form entries and page content for already-injected scripts before restoring normal operation.