CveMateVulnerability intelligence

Stylemix vulnerabilities, page 4

86 vulnerabilities

Known vulnerabilities in Stylemix products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 10 products.

CVE-2026-73404stylemixmasterstudy lms+12mo ago18-08-2026 14:00

Subscriber Broken Access Control in MasterStudy LMS <= 3.7.41 versions.CVE-2026-16750stylemixmotors – car dealership & classified listings plugin+11mo ago17-09-2026 21:28

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to unauthorized access of data due to missing authorization checks in mvl_ajax_dealer_load_cars() function in all versions up to, and including, 1.4.120. This makes it possible for unauthenticated attackers to retrieve draft, pending, private, and future car listings belonging to arbitrary users.CVE-2026-13114stylemixmotors – car dealership & classified listings plugin+13mo ago11-07-2026 02:31

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content and User Biographical Info in all versions up to, and including, 1.4.112 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2026-1934stylemixmotors – car dealership & classified listings plugin+15mo ago12-05-2026 08:27

The Motors – Car Dealership & Classified Listings plugin for WordPress is vulnerable to Payment Bypass via insecure user meta update in all versions up to, and including, 1.4.103 This is due to the stm_save_user_extra_fields() function updating sensitive user meta fields from POST data without verifying that the current user should have permission to modify those fields. The function hooks into the 'personal_options_update' action and only checks current_user_can('edit_user', $user_id), which passes for any user editing their own profile. This makes it possible for authenticated attackers, with Subscriber-level access and above, to set their stm_payment_status to 'completed', bypassing the PayPal payment verification and gaining access to paid Dealer membership features without completing any transaction.CVE-2026-19802stylemixcheckout custom fields builder for woocommerce+11mo ago09-09-2026 06:40

The Checkout Custom Fields Builder for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to install and activate an arbitrary attacker-hosted plugin, resulting in remote code execution on the server. The required nonce is emitted inline on all admin pages accessible to subscribers when WooCommerce is inactive, meaning any subscriber-level user can harvest it and trigger the exploit without any additional privileges.CVE-2026-62033stylemixulisting+110d ago10-10-2026 19:35

Subscriber Settings Change in uListing <= 2.2.0 versions.CVE-2026-62031stylemixulisting+110d ago10-10-2026 19:35

Unauthenticated SQL Injection in uListing <= 2.2.0 versions.CVE-2026-68568stylemixmasterstudy lms+12mo ago18-08-2026 13:59

Subscriber Privilege Escalation in MasterStudy LMS <= 3.7.41 versions.CVE-2026-42730stylemixmasterstudy lms+14mo ago27-05-2026 09:49

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Blind SQL Injection.This issue affects MasterStudy LMS: from n/a through <= 3.7.29.CVE-2026-0559stylemixmasterstudy lms wordpress plugin – for online courses and education+18mo ago14-02-2026 06:42

The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'stm_lms_courses_grid_display' shortcode in all versions up to, and including, 3.7.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2026-4817stylemixmasterstudy lms wordpress plugin – for online courses and education+16mo ago17-04-2026 01:24

The MasterStudy LMS WordPress Plugin for Online Courses and Education plugin for WordPress is vulnerable to Time-based Blind SQL Injection via the 'order' and 'orderby' parameters in the /lms/stm-lms/order/items REST API endpoint in versions up to and including 3.7.25. This is due to insufficient input sanitization combined with a design flaw in the custom Query builder class that allows unquoted SQL injection in ORDER BY clauses. When the Query builder detects parentheses in the sort_by parameter, it treats the value as a SQL function and directly concatenates it into the ORDER BY clause without any quoting. While esc_sql() is applied to escape quotes and backslashes, this cannot prevent ORDER BY injection when the values themselves are not wrapped in quotes in the resulting SQL statement. This makes it possible for authenticated attackers, with subscriber-level access and above, to append arbitrary SQL queries via the ORDER BY clause to extract sensitive information from the database including user credentials, session tokens, and other confidential data through time-based blind SQL injection techniques.CVE-2026-7753stylemixcost calculator builder+12mo ago05-08-2026 05:27

The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized access of sensitive data due to a missing capability check on the `cost-calculator-custom-export-run` AJAX action (handler `CCBExportImport::export_calculators()`) in all versions up to, and including, 3.6.17. The handler only verifies a nonce, but the corresponding `ccb_export_nonce` is broadcast on every wp-admin page (including pages reachable to Subscribers, such as `/wp-admin/profile.php`) by the `ccb_add_admin_nonces` callback hooked to `admin_head`. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export every calculator's full configuration — including stored Stripe secret keys, PayPal client secrets, Razorpay secret keys, webhook secret keys, and reCAPTCHA secret keys.CVE-2026-66693stylemixmotors+12mo ago13-08-2026 13:37

Subscriber Broken Access Control in Motors <= 1.4.113 versions.CVE-2026-27392stylemixulisting+12mo ago23-07-2026 11:17

Contributor Broken Access Control in uListing <= 2.2.0 versions.CVE-2026-27391stylemixulisting+12mo ago23-07-2026 11:17

Subscriber Broken Access Control in uListing <= 2.2.0 versions.CVE-2026-57640stylemixmasterstudy lms+13mo ago26-06-2026 14:53

Subscriber Broken Access Control in MasterStudy LMS <= 3.7.30 versions.CVE-2026-57330stylemixmasterstudy lms+13mo ago29-06-2026 13:36

Subscriber Cross Site Scripting (XSS) in MasterStudy LMS <= 3.7.27 versions.CVE-2026-5060stylemixmasterstudy lms wordpress plugin – for online courses and education+12mo ago29-07-2026 09:31

The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.14. This is due to the `stm_lms_delete_cover()` function lacking ownership validation on the `file_id` parameter before passing it to `wp_delete_attachment()`. This makes it possible for authenticated attackers, with Instructor-level access and above, to delete arbitrary attachments belonging to any user by enumerating sequential attachment IDs.CVE-2026-10865stylemixcost calculator builder+13mo ago11-07-2026 05:35

The Cost Calculator Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.11 via the (template body). This makes it possible for unauthenticated attackers to extract the plaintext Stripe secret key, Razorpay secret key, and PayPal client_secret embedded in the page source of any page containing a calculator, enabling full control of the merchant's payment gateway accounts. This exposure only occurs when the 'use in all calculators' option is enabled for one or more payment gateways in the plugin's global settings.CVE-2026-28078stylemixulisting+17mo ago05-03-2026 05:54

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Stylemix uListing ulisting allows Path Traversal.This issue affects uListing: from n/a through <= 2.2.0.