# CVE-2026-10865: StylemixThemes Cost Calculator Builder sensitive information exposure

Source: https://junglewise.ai/threats/cve-2026-10865-stylemixthemes-cost-calculator-builder-sensitive-information  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-11. Updated: 2026-07-11  
License: CC BY 4.0 with a link back

CVE-2026-10865 · Severity: medium · CVSS 5.3 · Published 2026-07-11

The Cost Calculator Builder plugin for WordPress, which allows site owners to create price estimation forms, contains a security flaw that exposes sensitive payment credentials. An unauthenticated attacker can view the website's source code to find plaintext secret keys for Stripe, Razorpay, and PayPal. This could allow an attacker to gain unauthorized access to the merchant's payment gateway accounts and financial data.

Technologies: [StylemixThemes Cost Calculator Builder](https://junglewise.ai/threats/technologies/cost-calculator-builder). Vendors: [StylemixThemes](https://junglewise.ai/threats/vendors/stylemixthemes).

## Quick answers

**Is CVE-2026-10865 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10865 being exploited in the wild.

**How severe is CVE-2026-10865?** Medium severity, with a CVSS score of 5.3, published 11 July 2026.

**Which products and versions are affected?** StylemixThemes Cost Calculator Builder up to, and including, 4.0.11.

**Is there a fix for CVE-2026-10865?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-10865 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-10865?** Check whether you run StylemixThemes Cost Calculator Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Cost Calculator Builder plugin for WordPress is vulnerable to sensitive information exposure (CWE-200) in versions up to and including 4.0.11. The vulnerability exists within the frontend template rendering logic, which embeds plaintext Stripe secret keys, Razorpay secret keys, and PayPal client_secrets directly into the HTML page source. This occurs when the 'use in all calculators' option is enabled for payment gateways in the plugin's global settings. An unauthenticated remote attacker can exploit this by simply viewing the source code of any page where a calculator is published. This exposure grants the attacker the credentials necessary to interact with the merchant's payment provider APIs.

## Affected products

- StylemixThemes Cost Calculator Builder up to, and including, 4.0.11

## Timeline

- 2026-07-11: disclosed: Initial publication of the CVE record.
- 2026-07-11: advisory

## References

- [https://plugins.trac.wordpress.org/browser/cost-calculator-builder/tags/3.6.17/includes/functions.php](https://plugins.trac.wordpress.org/browser/cost-calculator-builder/tags/3.6.17/includes/functions.php)
- [https://plugins.trac.wordpress.org/browser/cost-calculator-builder/tags/3.6.17/templates/frontend/render.php](https://plugins.trac.wordpress.org/browser/cost-calculator-builder/tags/3.6.17/templates/frontend/render.php)
- [https://plugins.trac.wordpress.org/browser/cost-calculator-builder/tags/3.6.17/templates/frontend/render.php](https://plugins.trac.wordpress.org/browser/cost-calculator-builder/tags/3.6.17/templates/frontend/render.php)
- [https://plugins.trac.wordpress.org/browser/cost-calculator-builder/tags/3.6.17/templates/frontend/render.php](https://plugins.trac.wordpress.org/browser/cost-calculator-builder/tags/3.6.17/templates/frontend/render.php)
- [https://plugins.trac.wordpress.org/browser/cost-calculator-builder/tags/4.0.5/includes/functions.php](https://plugins.trac.wordpress.org/browser/cost-calculator-builder/tags/4.0.5/includes/functions.php)
- [https://plugins.trac.wordpress.org/browser/cost-calculator-builder/tags/4.0.5/templates/frontend/render.php](https://plugins.trac.wordpress.org/browser/cost-calculator-builder/tags/4.0.5/templates/frontend/render.php)
- [https://plugins.trac.wordpress.org/browser/cost-calculator-builder/tags/4.0.5/templates/frontend/render.php](https://plugins.trac.wordpress.org/browser/cost-calculator-builder/tags/4.0.5/templates/frontend/render.php)

## Related threats

- [StylemixThemes Cost Calculator Builder sensitive data exposure](https://junglewise.ai/threats/cve-2026-97307-insertion-of-sensitive-information-into-sent-data-vulnerability)
- [StylemixThemes Cost Calculator Builder price manipulation via IDOR](https://junglewise.ai/threats/cve-2025-14755-stylemixthemes-cost-calculator-builder-price-manipulation-via)