Stylemix
77 CVEs across 9 Stylemix products. Browse Stylemix vulnerabilities, severities, and proof-of-concept exploits.
Stylemix products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-66693 | Medium | 6.5 | 2026-08-13 | Subscriber Broken Access Control in Motors <= 1.4.113 versions. |
CVE-2026-7753 | Medium | 6.5 | 2026-08-05 | The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized access of sensitive data due to a missing capability check on the `cost-calculat… |
CVE-2026-5060 | Medium | 6.5 | 2026-07-29 | The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions… |
CVE-2026-27392 | Medium | 4.3 | 2026-07-23 | Contributor Broken Access Control in uListing <= 2.2.0 versions. |
CVE-2026-27391 | Medium | 5.4 | 2026-07-23 | Subscriber Broken Access Control in uListing <= 2.2.0 versions. |
CVE-2026-10865 | Medium | 5.3 | 2026-07-11 | The Cost Calculator Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.11 via the (template… |
CVE-2026-13114 | High | 7.2 | 2026-07-11 | The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content and User Biograp… |
CVE-2026-12435 | Medium | 4.3 | 2026-07-01 | The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.1… |
CVE-2026-57330 | Medium | 6.5 | 2026-06-29 | Subscriber Cross Site Scripting (XSS) in MasterStudy LMS <= 3.7.27 versions. |
CVE-2026-57640 | Medium | 4.3 | 2026-06-26 | Subscriber Broken Access Control in MasterStudy LMS <= 3.7.30 versions. |
CVE-2026-42730 | High | 8.5 | 2026-05-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-managem… |
CVE-2026-3892 | High | 8.1 | 2026-05-14 | The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 1… |
CVE-2025-14755 | Medium | 5.3 | 2026-05-13 | The Cost Calculator Builder plugin for WordPress is vulnerable to Unauthenticated Price Manipulation and Insecure Direct Object Reference (IDOR) in all version… |
CVE-2026-1934 | Medium | 4.3 | 2026-05-12 | The Motors – Car Dealership & Classified Listings plugin for WordPress is vulnerable to Payment Bypass via insecure user meta update in all versions up to, and… |
CVE-2026-4817 | Medium | 6.5 | 2026-04-17 | The MasterStudy LMS WordPress Plugin for Online Courses and Education plugin for WordPress is vulnerable to Time-based Blind SQL Injection via the 'order' and… |
CVE-2026-28078 | Medium | 4.9 | 2026-03-05 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Stylemix uListing ulisting allows Path Traversal.This issue aff… |
CVE-2026-28138 | High | 7.2 | 2026-02-26 | Deserialization of Untrusted Data vulnerability in Stylemix uListing ulisting allows Object Injection.This issue affects uListing: from n/a through <= 2.2.0. |
CVE-2026-0559 | Medium | 6.4 | 2026-02-14 | The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'stm… |
CVE-2025-14757 | Medium | 5.3 | 2026-01-16 | The Cost Calculator Builder plugin for WordPress is vulnerable to Unauthenticated Payment Status Bypass in all versions up to, and including, 3.6.9 only when u… |
CVE-2025-13766 | Medium | 5.4 | 2026-01-06 | The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to unauthorized modification and deletion of data du… |
CVE-2025-12529 | High | 8.8 | 2025-12-02 | The Cost Calculator Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteOrdersFiles() f… |
CVE-2025-62049 | Medium | 6.5 | 2025-11-06 | Missing Authorization vulnerability in Stylemix Cost Calculator Builder cost-calculator-builder.This issue affects Cost Calculator Builder: from n/a through <=… |
CVE-2025-64366 | High | 7.6 | 2025-10-31 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-managem… |
CVE-2025-59575 | Medium | 4.9 | 2025-10-22 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system… |
CVE-2025-10494 | High | 8.1 | 2025-10-08 | The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation… |
CVE-2025-9243 | High | 8.1 | 2025-10-04 | The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorizedmodification of data due to a missing capability check on the get_cc_orders and u… |
CVE-2025-59577 | Medium | 4.3 | 2025-09-22 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-… |
CVE-2025-59576 | Medium | 6.5 | 2025-09-22 | Missing Authorization vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Exploiting Incorrectly Configured Access Cont… |
CVE-2025-54744 | Medium | 6.5 | 2025-09-05 | Missing Authorization vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Exploiting Incorrectly Configured Access Cont… |
CVE-2025-54691 | Medium | 5.3 | 2025-08-14 | Authorization Bypass Through User-Controlled Key vulnerability in Stylemix Motors motors-car-dealership-classified-listings allows Exploiting Incorrectly Confi… |
CVE-2025-48277 | Medium | 5.9 | 2025-05-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stylemix Cost Calculator Builder cost-calculator-builder… |
CVE-2025-39587 | Critical | 9.3 | 2025-04-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stylemix Cost Calculator Builder cost-calculator-builder… |
CVE-2025-32662 | High | 8.8 | 2025-04-17 | Deserialization of Untrusted Data vulnerability in Stylemix uListing ulisting allows Object Injection.This issue affects uListing: from n/a through <= 2.2.0. |
CVE-2025-2128 | Medium | 6.5 | 2025-04-11 | The Cost Calculator Builder plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order_ids’ parameter in all versions up to, and including… |
CVE-2025-32654 | High | 8.1 | 2025-04-11 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Stylemix Motors motors-car-dealership-… |
CVE-2025-3437 | Medium | 4.3 | 2025-04-08 | The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability ch… |
CVE-2025-2808 | Medium | 5.4 | 2025-04-08 | The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Phone Number parameter in al… |
CVE-2025-2807 | High | 8.8 | 2025-04-08 | The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary plugin installations due to a missing capability check… |
CVE-2025-32237 | Medium | 4.3 | 2025-04-04 | Missing Authorization vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Exploiting Incorrectly Configured Access Cont… |
CVE-2025-32170 | Medium | 6.5 | 2025-04-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stylemix Motors motors-car-dealership-classified-listings… |
CVE-2025-32142 | High | 8.8 | 2025-04-04 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Stylemix Motors motors-car-dealership-… |
CVE-2025-32141 | High | 8.8 | 2025-04-04 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Stylemix MasterStudy LMS masterstudy-l… |
CVE-2025-32122 | High | 7.6 | 2025-04-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stylemix uListing ulisting allows Blind SQL Injection.Thi… |
CVE-2025-31881 | Medium | 5.4 | 2025-04-01 | Missing Authorization vulnerability in Stylemix Pearl pearl-header-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2025-31880 | Medium | 4.3 | 2025-04-01 | Cross-Site Request Forgery (CSRF) vulnerability in Stylemix Pearl pearl-header-builder allows Cross Site Request Forgery.This issue affects Pearl: from n/a thr… |
CVE-2025-31414 | Medium | 6.5 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stylemix Cost Calculator Builder cost-calculator-builder… |
CVE-2024-13737 | Medium | 4.3 | 2025-03-22 | The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability checks on th… |
CVE-2025-1657 | High | 8.8 | 2025-03-15 | The Directory Listings WordPress plugin – uListing plugin for WordPress is vulnerable to unauthorized modification of data and PHP Object Injection due to a mi… |
CVE-2025-1653 | High | 8.8 | 2025-03-15 | The Directory Listings WordPress plugin – uListing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.2.0. This… |
CVE-2025-25150 | Critical | 9.3 | 2025-03-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stylemix uListing ulisting allows Blind SQL Injection.Thi… |
CVE-2025-25151 | High | 8.5 | 2025-02-07 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stylemix uListing ulisting allows SQL Injection.This issu… |
CVE-2024-10970 | Medium | 5.4 | 2025-01-16 | The The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1… |
CVE-2024-12206 | Medium | 4.3 | 2025-01-09 | The WordPress Header Builder Plugin – Pearl plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.8. This… |
CVE-2024-37093 | Medium | 4.3 | 2025-01-02 | Cross-Site Request Forgery (CSRF) vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Cross Site Request Forgery.This i… |
CVE-2024-47344 | Medium | 5.3 | 2024-10-07 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Stylemix uListing ulisting.This issue affects uListing: from n/a through <= 2.1.5. |
CVE-2024-6012 | Medium | 4.3 | 2024-07-02 | The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'embed-create-page… |
CVE-2024-6011 | Medium | 4.4 | 2024-07-02 | The Cost Calculator Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘textarea.description’ parameter in all versions up to, a… |
CVE-2024-5545 | Medium | 5.3 | 2024-07-02 | The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the… |
CVE-2024-5468 | Medium | 6.5 | 2024-06-12 | The WordPress Header Builder Plugin – Pearl plugin for WordPress is vulnerable to unauthorized site option deletion due to a missing validation and capability… |
CVE-2024-4000 | Medium | 6.4 | 2024-05-02 | The WordPress Header Builder Plugin – Pearl plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'stm_hb' shortcode in all versio… |
CVE-2024-3942 | Medium | 6.3 | 2024-05-02 | The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to unauthorized access, modification, and loss of da… |
CVE-2024-3136 | Critical | 9.8 | 2024-04-09 | The MasterStudy LMS plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.3 via the 'template' parameter. This m… |
CVE-2024-1904 | Medium | 4.3 | 2024-04-09 | The MasterStudy LMS plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the search_posts function in all ver… |
CVE-2024-2411 | Critical | 9.8 | 2024-03-29 | The MasterStudy LMS plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.0 via the 'modal' parameter. This make… |
CVE-2024-2409 | Critical | 9.8 | 2024-03-29 | The MasterStudy LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.3.1. This is due to insufficient validat… |
CVE-2024-2106 | Medium | 5.3 | 2024-03-13 | The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Information Exposure in versions up to, and inclu… |
CVE-2024-1512 | Critical | 9.8 | 2024-02-17 | The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to union based SQL Injection via the 'user' paramete… |
CVE-2021-4381 | Critical | 9.8 | 2023-06-07 | The uListing plugin for WordPress is vulnerable to authorization bypass via wp_route due to missing capability checks, and a missing security nonce, in the Stm… |
CVE-2021-4370 | Critical | 9.8 | 2023-06-07 | The uListing plugin for WordPress is vulnerable to authorization bypass as most actions and endpoints are accessible to unauthenticated users, lack security no… |
CVE-2021-4357 | Critical | 9.1 | 2023-06-07 | The uListing plugin for WordPress is vulnerable to authorization bypass due to missing capability checks, and a missing security nonce, on the UlistingUserRole… |
CVE-2021-4346 | Critical | 9.8 | 2023-06-07 | The uListing plugin for WordPress is vulnerable to Unauthenticated Arbitrary Account Changes in versions up to, and including, 1.6.6. This is due to missing lo… |
CVE-2021-4345 | Medium | 6.5 | 2023-06-07 | The uListing plugin for WordPress is vulnerable to authorization bypass due to missing capability and nonce checks on the UlistingUserRole::save_role_api metho… |
CVE-2021-4343 | Critical | 9.8 | 2023-06-07 | The Unauthenticated Account Creation plugin for WordPress is vulnerable to Unauthenticated Account Creation in versions up to, and including, 1.6.6. This is du… |
CVE-2021-4341 | Critical | 9.8 | 2023-06-07 | The uListing plugin for WordPress is vulnerable to authorization bypass via Ajax due to missing capability checks, missing input validation, and a missing secu… |
CVE-2021-4340 | Critical | 9.8 | 2023-06-07 | The uListing plugin for WordPress is vulnerable to generic SQL Injection via the ‘listing_id’ parameter in versions up to, and including, 1.6.6 due to insuffic… |
CVE-2021-4339 | High | 7.5 | 2023-06-07 | The uListing plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in the "ulisting/includes/route.php" file on the /1/a… |
CVE-2021-36875 | Medium | 5.9 | 2021-09-27 | Cross-site Scripting (XSS) vulnerability in Stylemix Directory Listings WordPress plugin – uListing allows Reflected XSS.This issue affects Directory Listings… |