Cost Calculator Builder PRO
Cost Calculator Builder PRO is a WordPress component with 3 published CVE records in this archive. The latest tracked vulnerability was published Jul 29, 2026; the highest published CVSS base score is 9.8.
cost-calculator-builder-proCVE-2026-14900: Cost Calculator Builder PRO permits unauthenticated PHP code execution through calculator formulas
Cost Calculator Builder PRO through 4.0.3 is vulnerable to unauthenticated remote code execution in js_to_php(). An attacker obtains the plugin nonce that is publicly emitted on front-end pages by the wp_head hook, then submits crafted orderDetails[*].originalValue data. The plugin inserts originalValue verbatim into a calculator formula passed to evaluateFormula(); its token filter removes disallowed alphanumeric names but leaves non-word punctuation, allowing a non-word XOR gadget to reach PHP eval() and execute server-side code. The authoritative record does not disclose the HTTP endpoint, action name, or outer request parameter carrying orderDetails. The affected range ends at 4.0.3; 4.0.4 is the first later published release, although the public vendor changelog does not explicitly identify this security fix.
| Safe version |
|
||
|---|---|---|---|
| Jul 29, 2026 |
CVE-2026-14900
Cost Calculator Builder PRO permits unauthenticated PHP code execution through calculator formulas
Cost Calculator Builder PRO through 4.0.3 is vulnerable to unauthenticated remote code execution in js_to_php(). An attacker obtains the plugin nonce that is publicly emitted on front-end pages by the wp_head hook, then submits crafted orderDetails[*].originalValue data. The plugin inserts originalValue verbatim into a calculator formula passed to evaluateFormula(); its token filter removes disallowed alphanumeric names but leaves non-word punctuation, allowing a non-word XOR gadget to reach PHP eval() and execute server-side code. The authoritative record does not disclose the HTTP endpoint, action name, or outer request parameter carrying orderDetails. The affected range ends at 4.0.3; 4.0.4 is the first later published release, although the public vendor changelog does not explicitly identify this security fix.
|
4.0.4 |
CVE9.8
NVDPending
|
| Jan 08, 2025 |
CVE-2024-11939
Cost Calculator Builder PRO: SQL injection
Cost Calculator Builder PRO is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.
|
See mitigation notes |
CVE7.5
NVDPending
|
| May 17, 2024 |
CVE-2024-4789
Cost Calculator Builder Pro: Server-side request forgery
Cost Calculator Builder Pro is affected by server-side request forgery. Exploitation requires an authenticated subscriber account. The vulnerable server can be induced to make attacker-selected network requests. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.
|
See mitigation notes |
CVE6.4
NVDPending
|