Stylemixthemes
56 CVEs across 34 Stylemixthemes products. Browse Stylemixthemes vulnerabilities, severities, and proof-of-concept exploits.
Stylemixthemes products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-28145 | Medium | 5.3 | 2026-07-31 | Insufficient Verification of Data Authenticity vulnerability in StylemixThemes MasterStudy LMS allows Manipulating User State. This issue affects MasterStudy… |
CVE-2026-14900 | Critical | 9.8 | 2026-07-29 | The Cost Calculator Builder PRO plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.0.3 via the js_to_php funct… |
CVE-2026-27433 | Medium | 6.5 | 2026-07-02 | Unauthenticated Broken Access Control in Motors <= 5.6.80 versions. |
CVE-2026-27412 | High | 8.1 | 2026-07-02 | Unauthenticated Local File Inclusion in Pearl - Corporate Business <= 3.4.10 versions. |
CVE-2025-68063 | High | 7.5 | 2026-06-26 | Contributor Local File Inclusion in Splash - Sport Club WordPress Theme for Basketball, Football, Hockey <= 4.4.3 versions. |
CVE-2026-54828 | High | 7.5 | 2026-06-25 | Unauthenticated Broken Access Control in Motors <= 1.4.109 versions. |
CVE-2026-54812 | Critical | 9.3 | 2026-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Motors allows Blind SQL Injection. This i… |
CVE-2026-54814 | High | 8.1 | 2026-06-17 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Motors allows PHP Local… |
CVE-2026-40766 | High | 8.5 | 2026-06-15 | Subscriber SQL Injection in MasterStudy LMS <= 3.7.25 versions. |
CVE-2026-39515 | Medium | 6.5 | 2026-06-15 | Subscriber Broken Access Control in Motors < 1.4.107 versions. |
CVE-2025-64215 | Medium | 6.5 | 2026-06-15 | Missing Authorization vulnerability in StylemixThemes MasterStudy LMS Pro allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects… |
CVE-2026-8653 | Medium | 6.5 | 2026-06-04 | The MasterStudy LMS Pro Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'columns' parameter in all versions up to, and including, 4.8… |
CVE-2025-14757 | Medium | 5.3 | 2026-01-16 | The Cost Calculator Builder plugin for WordPress is vulnerable to Unauthenticated Payment Status Bypass in all versions up to, and including, 3.6.9 only when u… |
CVE-2025-64374 | Critical | 9.9 | 2025-12-18 | Unrestricted Upload of File with Dangerous Type vulnerability in StylemixThemes Motors motors allows Using Malicious Files.This issue affects Motors: from n/a… |
CVE-2025-64214 | High | 7.5 | 2025-12-18 | Missing Authorization vulnerability in StylemixThemes MasterStudy LMS Pro masterstudy-lms-learning-management-system-pro allows Accessing Functionality Not Pro… |
CVE-2025-64213 | High | 7.5 | 2025-12-18 | Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes MasterStudy LMS Pro masterstudy-lms-learning-management-system-pro allows Ret… |
CVE-2025-64209 | High | 7.5 | 2025-12-18 | Missing Authorization vulnerability in StylemixThemes Masterstudy masterstudy allows Accessing Functionality Not Properly Constrained by ACLs.This issue affect… |
CVE-2025-64364 | High | 7.5 | 2025-10-31 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Masterstudy masterstudy… |
CVE-2025-64361 | Medium | 6.5 | 2025-10-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StylemixThemes Consulting Elementor Widgets consulting-el… |
CVE-2025-64360 | High | 7.5 | 2025-10-31 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Consulting Elementor Wi… |
CVE-2025-64359 | High | 7.5 | 2025-10-31 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Consulting consulting a… |
CVE-2025-64212 | Medium | 5.4 | 2025-10-29 | Missing Authorization vulnerability in StylemixThemes MasterStudy LMS Pro masterstudy-lms-learning-management-system-pro allows Exploiting Incorrectly Configur… |
CVE-2025-64211 | Medium | 5.3 | 2025-10-29 | Missing Authorization vulnerability in StylemixThemes Masterstudy Elementor Widgets masterstudy-elementor-widgets allows Accessing Functionality Not Properly C… |
CVE-2025-64210 | Medium | 5.4 | 2025-10-29 | Missing Authorization vulnerability in StylemixThemes Masterstudy Elementor Widgets masterstudy-elementor-widgets allows Exploiting Incorrectly Configured Acce… |
CVE-2025-7438 | High | 7.5 | 2025-07-18 | The MasterStudy LMS Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'install_and_activate_plug… |
CVE-2025-47586 | Critical | 9.0 | 2025-06-06 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Motors - Events stm-mot… |
CVE-2025-4800 | High | 8.8 | 2025-05-28 | The MasterStudy LMS Pro plugin for WordPress is vulnerable to arbitrary file uploads due to a missing file type validation in the stm_lms_add_assignment_attach… |
CVE-2025-4322 | Critical | 9.8 | 2025-05-20 | The Motors theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.6.67. This is due to the them… |
CVE-2024-13738 | High | 7.3 | 2025-05-03 | The The Motors - Car Dealer, Rental & Listing WordPress theme theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and inc… |
CVE-2025-3437 | Medium | 4.3 | 2025-04-08 | The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability ch… |
CVE-2025-2808 | Medium | 5.4 | 2025-04-08 | The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Phone Number parameter in al… |
CVE-2025-2807 | High | 8.8 | 2025-04-08 | The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary plugin installations due to a missing capability check… |
CVE-2025-26986 | High | 8.1 | 2025-03-26 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Pearl - Corporate Busin… |
CVE-2024-13737 | Medium | 4.3 | 2025-03-22 | The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability checks on th… |
CVE-2025-1657 | High | 8.8 | 2025-03-15 | The Directory Listings WordPress plugin – uListing plugin for WordPress is vulnerable to unauthorized modification of data and PHP Object Injection due to a mi… |
CVE-2025-1653 | High | 8.8 | 2025-03-15 | The Directory Listings WordPress plugin – uListing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.2.0. This… |
CVE-2024-10970 | Medium | 5.4 | 2025-01-16 | The The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1… |
CVE-2024-11939 | High | 7.5 | 2025-01-08 | The Cost Calculator Builder PRO plugin for WordPress is vulnerable to blind time-based SQL Injection via the ‘data’ parameter in all versions up to, and includ… |
CVE-2024-37093 | Medium | 4.3 | 2025-01-02 | Cross-Site Request Forgery (CSRF) vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Cross Site Request Forgery.This i… |
CVE-2024-10892 | Medium | 5.4 | 2024-12-18 | The Cost Calculator Builder WordPress plugin before 3.2.43 does not have CSRF checks in some AJAX actions, which could allow attackers to make logged in users… |
CVE-2023-40011 | Medium | 5.4 | 2024-12-13 | Missing Authorization vulnerability in StylemixThemes Cost Calculator Builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2022-43472 | Medium | 4.3 | 2024-12-13 | Missing Authorization vulnerability in StylemixThemes eRoom – Zoom Meetings & Webinar allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2024-37269 | Medium | 5.3 | 2024-11-01 | Missing Authorization vulnerability in StylemixThemes Masterstudy Elementor Widgets allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2024-37094 | High | 8.2 | 2024-11-01 | Missing Authorization vulnerability in StylemixThemes MasterStudy LMS allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affe… |
CVE-2024-8379 | High | 7.2 | 2024-09-30 | The Cost Calculator Builder WordPress plugin before 3.2.29 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a S… |
CVE-2024-43990 | Medium | 5.3 | 2024-09-25 | Insertion of Sensitive Information into Log File vulnerability in StylemixThemes Masterstudy LMS Starter.This issue affects Masterstudy LMS Starter: from n/a t… |
CVE-2024-6010 | Medium | 5.3 | 2024-09-07 | The Cost Calculator Builder PRO plugin for WordPress is vulnerable to price manipulation in all versions up to, and including, 3.2.1. This is due to the plugin… |
CVE-2024-43144 | Critical | 9.3 | 2024-08-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Cost Calculator Builder allows SQL Injecti… |
CVE-2024-5973 | High | 8.8 | 2024-07-22 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.3.24 does not prevent students from creating instructor accounts, which could be used to get ac… |
CVE-2024-37090 | High | 8.5 | 2024-07-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Masterstudy Elementor Widgets, StylemixThe… |
CVE-2024-6012 | Medium | 4.3 | 2024-07-02 | The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'embed-create-page… |
CVE-2024-6011 | Medium | 4.4 | 2024-07-02 | The Cost Calculator Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘textarea.description’ parameter in all versions up to, a… |
CVE-2024-5545 | Medium | 5.3 | 2024-07-02 | The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the… |
CVE-2024-37092 | High | 8.5 | 2024-06-24 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in StylemixThemes Consulting Elementor Widgets allows PHP Local Fi… |
CVE-2024-37091 | Critical | 9.9 | 2024-06-24 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in StylemixThemes Consulting Elementor Widgets, StylemixTheme… |
CVE-2024-37089 | Critical | 9.0 | 2024-06-24 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in StylemixThemes Consulting Elementor Widgets allows PHP Local Fi… |
CVE-2024-4787 | Medium | 5.8 | 2024-06-19 | The Cost Calculator Builder PRO for WordPress is vulnerable to arbitrary email sending vulnerability in versions up to, and including, 3.1.75. This is due to i… |
CVE-2024-35677 | Critical | 9.0 | 2024-06-10 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in StylemixThemes MegaMenu allows PHP Local File Inclusion.This is… |
CVE-2024-4789 | Medium | 6.4 | 2024-05-17 | Cost Calculator Builder Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to 3.1.72, via the send_demo_webhook() functio… |
CVE-2023-37385 | High | 7.3 | 2024-05-17 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in StylemixThemes Consulting allows PHP Local File Inclusion.This… |
CVE-2024-4097 | High | 7.2 | 2024-05-02 | The Cost Calculator Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the SVG upload feature in all versions up to, and including… |
CVE-2024-3942 | Medium | 6.3 | 2024-05-02 | The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to unauthorized access, modification, and loss of da… |
CVE-2024-3136 | Critical | 9.8 | 2024-04-09 | The MasterStudy LMS plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.3 via the 'template' parameter. This m… |
CVE-2024-1904 | Medium | 4.3 | 2024-04-09 | The MasterStudy LMS plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the search_posts function in all ver… |
CVE-2024-2411 | Critical | 9.8 | 2024-03-29 | The MasterStudy LMS plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.0 via the 'modal' parameter. This make… |
CVE-2024-2409 | Critical | 9.8 | 2024-03-29 | The MasterStudy LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.3.1. This is due to insufficient validat… |
CVE-2024-2106 | Medium | 5.3 | 2024-03-13 | The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Information Exposure in versions up to, and inclu… |
CVE-2024-1512 | Critical | 9.8 | 2024-02-17 | The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to union based SQL Injection via the 'user' paramete… |
CVE-2023-50852 | High | 7.6 | 2023-12-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Booking Calendar | Appointment Booking | B… |
CVE-2023-46207 | Medium | 4.1 | 2023-11-13 | Server-Side Request Forgery (SSRF) vulnerability in StylemixThemes Motors – Car Dealer, Classifieds & Listing.This issue affects Motors – Car Dealer, Classifie… |
CVE-2023-46208 | High | 7.1 | 2023-10-27 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in StylemixThemes Motors – Car Dealer, Classifieds & Listing plugin <= 1.4.6 versions. |
CVE-2023-4278 | High | 7.5 | 2023-09-11 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.0.18 does not have proper checks in place during registration allowing anyone to register on the… |
CVE-2023-2834 | Critical | 9.8 | 2023-06-30 | The BookIt plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.3.7. This is due to insufficient verification on the… |
CVE-2023-35093 | Medium | 6.5 | 2023-06-22 | Broken Access Control vulnerability in StylemixThemes MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin <= 3.0.8 versions allows any l… |
CVE-2023-35090 | Medium | 6.5 | 2023-06-22 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in StylemixThemes MasterStudy LMS WordPress Plugin – for Online Courses and Education plug… |
CVE-2021-4381 | Critical | 9.8 | 2023-06-07 | The uListing plugin for WordPress is vulnerable to authorization bypass via wp_route due to missing capability checks, and a missing security nonce, in the Stm… |
CVE-2021-4370 | Critical | 9.8 | 2023-06-07 | The uListing plugin for WordPress is vulnerable to authorization bypass as most actions and endpoints are accessible to unauthenticated users, lack security no… |
CVE-2021-4357 | Critical | 9.1 | 2023-06-07 | The uListing plugin for WordPress is vulnerable to authorization bypass due to missing capability checks, and a missing security nonce, on the UlistingUserRole… |
CVE-2021-4346 | Critical | 9.8 | 2023-06-07 | The uListing plugin for WordPress is vulnerable to Unauthenticated Arbitrary Account Changes in versions up to, and including, 1.6.6. This is due to missing lo… |
CVE-2021-4345 | Medium | 6.5 | 2023-06-07 | The uListing plugin for WordPress is vulnerable to authorization bypass due to missing capability and nonce checks on the UlistingUserRole::save_role_api metho… |
CVE-2021-4343 | Critical | 9.8 | 2023-06-07 | The Unauthenticated Account Creation plugin for WordPress is vulnerable to Unauthenticated Account Creation in versions up to, and including, 1.6.6. This is du… |
CVE-2021-4341 | Critical | 9.8 | 2023-06-07 | The uListing plugin for WordPress is vulnerable to authorization bypass via Ajax due to missing capability checks, missing input validation, and a missing secu… |
CVE-2021-4340 | Critical | 9.8 | 2023-06-07 | The uListing plugin for WordPress is vulnerable to generic SQL Injection via the ‘listing_id’ parameter in versions up to, and including, 1.6.6 due to insuffic… |
CVE-2021-4339 | High | 7.5 | 2023-06-07 | The uListing plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in the "ulisting/includes/route.php" file on the /1/a… |
CVE-2022-45815 | Medium | 4.3 | 2023-05-25 | Cross-Site Request Forgery (CSRF) vulnerability in StylemixThemes GDPR Compliance & Cookie Consent plugin <= 1.2 versions. |
CVE-2022-38716 | Medium | 5.4 | 2023-05-25 | Cross-Site Request Forgery (CSRF) vulnerability in StylemixThemes Motors – Car Dealer, Classifieds & Listing plugin <= 1.4.4 versions. |
CVE-2022-38356 | Medium | 5.4 | 2023-05-25 | Cross-Site Request Forgery (CSRF) vulnerability in StylemixThemes WordPress Header Builder Plugin – Pearl plugin <= 1.3.4 versions. |
CVE-2022-3989 | High | 8.8 | 2022-12-12 | The Motors WordPress plugin before 1.4.4 does not properly validate uploaded files for dangerous file types (such as .php) in an AJAX action, allowing an attac… |
CVE-2022-25615 | Medium | 4.3 | 2022-04-11 | Cross-Site Request Forgery (CSRF) in StylemixThemes eRoom – Zoom Meetings & Webinar (WordPress plugin) <= 1.3.8 allows cache deletion. |
CVE-2022-25614 | Medium | 4.3 | 2022-04-11 | Cross-Site Request Forgery (CSRF) in StylemixThemes eRoom – Zoom Meetings & Webinar (WordPress plugin) <= 1.3.7 allows an attacker to Sync with Zoom Meetings. |
CVE-2022-0441 | Critical | 9.8 | 2022-03-07 | The MasterStudy LMS WordPress plugin before 2.7.6 does to validate some parameters given when registering a new account, allowing unauthenticated users to regi… |
CVE-2021-36880 | High | 8.6 | 2021-09-27 | Unauthenticated SQL Injection (SQLi) vulnerability in WordPress uListing plugin (versions <= 2.0.3), vulnerable parameter: custom. |
CVE-2021-36879 | Critical | 9.8 | 2021-09-27 | Unauthenticated Privilege Escalation vulnerability in WordPress uListing plugin (versions <= 2.0.5). Possible if WordPress configuration allows user registrati… |
CVE-2021-36877 | Medium | 4.3 | 2021-09-27 | Cross-Site Request Forgery (CSRF) vulnerability in WordPress uListing plugin (versions <= 2.0.5) makes it possible for attackers to modify user roles. |
CVE-2021-36876 | Medium | 5.4 | 2021-09-27 | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in WordPress uListing plugin (versions <= 2.0.5) as it lacks CSRF checks on plugin administration pa… |
CVE-2021-36875 | Medium | 5.9 | 2021-09-27 | Cross-site Scripting (XSS) vulnerability in Stylemix Directory Listings WordPress plugin – uListing allows Reflected XSS.This issue affects Directory Listings… |
CVE-2021-36874 | High | 7.1 | 2021-09-27 | Authenticated Insecure Direct Object References (IDOR) vulnerability in WordPress uListing plugin (versions <= 2.0.5). |
CVE-2021-36878 | Medium | 4.3 | 2021-09-27 | Cross-Site Request Forgery (CSRF) vulnerability in WordPress uListing plugin (versions <= 2.0.5) makes it possible for attackers to update settings. |
CVE-2019-17229 | Medium | 6.1 | 2020-02-24 | includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for WordPress has multipl… |
CVE-2019-17228 | Medium | 6.5 | 2020-02-24 | includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for WordPress allows unau… |