xss_stored
KalkulackaServis::render() and KalkulackaRenovace::render() pass Elementor get_settings_for_display() values into render/kalkulacka-servis.php and render/kalkulacka-renovace.php. Those templates echo $titulek and $popis raw into the page and splice unit-price settings into an inline <script> as JavaScript numeric literals, using only esc_html() (HTML entity encoding). esc_html does not encode commas, parentheses, or semicolons, so a NUMBER setting such as 1,alert(document.domain),1 becomes executable JavaScript via the comma operator inside the script block. The same pattern exists for okenni_kridlo, balkonove_dvere_kridlo, psk_hs_portal, tesneni (service widget) and okenni_kridlo_od/do, euro_okno_od/do (renovation widget). $titulek is a TEXT control intended as a heading and is not escaped; $popis is a TEXTAREA whose default is HTML, so it is an intentional HTML field but is printed with no wp_kses_post. Write path is Elementor document save into _elementor_data (edit_post + Elementor Role Manager), not a plugin AJAX handler. On a default Elementor Role Manager only administrators can save; if editor/author/contributor is granted Elementor access they can persist a payload that runs for every visitor. The client-side innerHTML assignment of CzechPrice(parseFloat(input)) is not an XSS sink. Subscriber/customer cannot write these settings.
render/kalkulacka-servis.php:11-57
RecommendationEscape $titulek with esc_html() (or esc_attr() if used in attributes). Print $popis with wp_kses_post(). For values interpolated into JavaScript, cast with floatval() (or absint()) or pass them through wp_json_encode() / wp_localize_script() instead of esc_html() inside a <script> block. Same fixes in render/kalkulacka-renovace.php (title, description, and the four price literals around lines 42-45).