CVE-2026-14900

The Cost Calculator Builder PRO plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.0.3 via the js_to_php function. This is due to insufficient sanitization of the orderDetails[*].originalValue field, which is injected verbatim into a calculator formula string passed to PHP eval() inside js_to_php(), with the regex allow-list in evaluateFormula() only filtering alphanumeric tokens and leaving non-word punctuation characters intact. This makes it possible for unauthenticated attackers to execute code on the server. The only authentication barrier is a nonce check, but the required nonce is publicly emitted on every front-end page via the wp_head hook, making it freely obtainable by unauthenticated visitors. Payloads must be non-word XOR gadgets to bypass sanitization.

• CWE-94

• https://stylemixthemes.com/cost-calculator-plugin/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/4c8f2872-06ff-41a2-b601-77a47470de0c?source=cve

Published

Jul 29, 2026

Last Modified

Jul 30, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-14894The Super Forms – Drag & Drop Form Builder plugin for WordPr…9.8
• CVE-2026-14895String::Util versions before 1.36 for Perl are susceptible t…7.5
• CVE-2026-14896HashiCorp Nomad and Nomad Enterprise are vulnerable to a cro…4.2
• CVE-2026-14898The OpenAI Codex desktop app for macOS rendered remote image…6.5
• CVE-2026-14899The code to parse MIME headers for display when forwarding a…7.5
• CVE-2026-1490The Spam protection, Anti-Spam, FireWall by CleanTalk plugin…9.8
• CVE-2026-14902An open redirect in Ivanti Xtraction before version 2026.2.1…6.1
• CVE-2026-14903Path traversal in Ivanti  Xtraction before version 2026.2.1 …6.5
• CVE-2026-14904AWS Research and Engineering Studio (RES) is an open-source …7.1
• CVE-2026-14906Pages with malicious titles could potentially allow saved PD…5.3
• CVE-2026-1491IBM Verify Identity Access Container 11.0 through 11.0.2 and…5.3
• CVE-2026-14919The ShopMonitor.io WordPress plugin before 1.2.0 does not p…9.8