CVE Explorer

CVE-2026-14900

The Cost Calculator Builder PRO plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.0.3 via the js_to_php function. This is due to insufficient sanitization of the orderDetails[*].originalValue field, which is injected verbatim into a calculator formula string passed to PHP eval() inside js_to_php(), with the regex allow-list in evaluateFormula() only filtering alphanumeric tokens and leaving non-word punctuation characters intact. This makes it po

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:24a46b66560ac33f660fa148fc06a687205f05e31523a56b21637f5140410f99

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"defaultStatus":"unaffected","product":"Cost Calculator Builder PRO","vendor":"StylemixThemes","versions":[{"lessThanOrEqual":"4.0.3","status":"affected","version":"0","versionType":"semver"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:a15371b0fd5cec22afb728d086232b54de391135a76045c8ba711f0517fdf500 · sha256:7ff0e5833e7e354c… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:a15371b0fd5cec22afb728d086232b54de391135a76045c8ba711f0517fdf500 · sha256:7ff0e5833e7e354c… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion

{"cweId":"CWE-94","description":"CWE-94 Improper Control of Generation of Code ('Code Injection')","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:a15371b0fd5cec22afb728d086232b54de391135a76045c8ba711f0517fdf500 · sha256:7ff0e5833e7e354c… · /containers/cna/problemTypes/0/descriptions/0

Source references

2 source assertions

{"url":"https://stylemixthemes.com/cost-calculator-plugin/"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:a15371b0fd5cec22afb728d086232b54de391135a76045c8ba711f0517fdf500 · sha256:7ff0e5833e7e354c… · /containers/cna/references/1

{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4c8f2872-06ff-41a2-b601-77a47470de0c?source=cve"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:a15371b0fd5cec22afb728d086232b54de391135a76045c8ba711f0517fdf500 · sha256:7ff0e5833e7e354c… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer