Mortgage Calculator
Mortgage Calculator has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2025; 1 is fixed and 1 remains unpatched as of October 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 2 of the records (100%).
1 of the records (50%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2025.
2 independent researchers contributed these findings, one record each. Mortgage Calculator is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2025-0805Mortgage Calculator / Loan Calculator <= 1.5.20 - Authenticated (Contributor+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records

Mortgage Calculator
Author
Mortgage Calculator
This plugin adds a mortgage and loan calculator to your WordPress site, as a sidebar widget or with the [mlcalc] shortcode. Visitors enter the purchase price or loan amount, down payment, rate and term, then press Calculate to see a summary, a chart and an amortization schedule in a popup. It is built for mortgage loan officers, real-estate agents and finance or home-buying sites. The calculation and the results popup are provided by the MLCALC.com service, which means the calculator needs an internet connection and sends the entered values there when Calculate is pressed (see External services below). Features Mortgage calculator with property tax, home insurance and PMI Loan calculator for general loans Summary, chart and amortization schedule (by month or by year) in a popup window Choose which calculators to show: mortgage and loan, mortgage only or loan only Narrow (150px) or wide (300px) form, suitable for sidebars and page content Preset default values with shortcode attributes or in the widget settings Currency: US dollar, euro, pound or a currency code of your own Interface languages: English, German, Spanish, French, Italian, Russian, Portuguese and Albanian CSS, JavaScript and images are bundled with the plugin and loaded from your own server Free for commercial use How to use Add the shortcode to a page or post: [mlcalc] Set default values: [mlcalc default="mortgage" size="narrow" price="125,000" rate="6.2" language="es" currency="eur"] You can also add the “Mortgage Calculator” widget under Appearance > Widgets, or call <?php display_mlcalc(); ?> from a theme template. Shortcode parameters default = mortgage | loan | mortgage_only | loan_only size = wide | narrow currency = usd | eur | gbp | any code of your own rate = interest rate price = purchase price mterm = mortgage term in years down = down payment in percent tax = property tax insurance = property insurance pmi = PMI in percent amount = loan amount lterm = loan term in years schedule = month | year | month_nc | year_nc | none (_nc stands for “no choice” for the visitor) language = en | de | es | fr | it | pt | ru | al Shortcode examples [mlcalc] [mlcalc default="mortgage_only"] [mlcalc default="loan_only" amount="20,000" lterm="5"] [mlcalc default="mortgage" size="narrow" price="125,000" rate="6.2" language="es" currency="eur"] External services This plugin relies on the MLCALC.com calculator service to compute and display results. When a visitor presses “Calculate”, the values typed into the form (purchase price or loan amount, down payment, term, interest rate, property tax, insurance, PMI, start date, currency and language) are sent to https://www.mlcalc.com/ and the results page opens in a popup window served by mlcalc.com. Nothing is sent until the visitor submits the form, and no personal data is collected. The service is provided by ARSIDIAN LLC: Terms of use, Privacy policy.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C