CveMateVulnerability intelligence

Stylemixthemes vulnerabilities, page 5

105 vulnerabilities

Known vulnerabilities in Stylemixthemes products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 28 products.

CVE-2019-17228stylemixthemesmotors_-_car_dealer\,_classifieds_\&_listing+16y ago24-02-2020 18:25

includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for WordPress allows unauthenticated options changes.CVE-2026-54828stylemixthemesmotors+13mo ago25-06-2026 13:12

Unauthenticated Broken Access Control in Motors <= 1.4.109 versions.CVE-2026-54812stylemixthemesmotors+14mo ago17-06-2026 14:24

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Blind SQL Injection.This issue affects Motors: from n/a through 1.4.109.CVE-2026-54814stylemixthemesmotors+14mo ago17-06-2026 13:41

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Motors allows PHP Local File Inclusion. This issue affects Motors: from n/a through 1.4.109.CVE-2026-105079stylemixthemesmasterstudy_lms+113d ago08-10-2026 13:04

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-management-system allows Stored XSS.This issue affects MasterStudy LMS: from n/a through 3.7.52.CVE-2026-40766stylemixthemesmasterstudy_lms+14mo ago15-06-2026 20:18

Subscriber SQL Injection in MasterStudy LMS <= 3.7.25 versions.CVE-2026-14900stylemixthemescost calculator builder pro+12mo ago29-07-2026 09:31

The Cost Calculator Builder PRO plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.0.3 via the js_to_php function. This is due to insufficient sanitization of the orderDetails[*].originalValue field, which is injected verbatim into a calculator formula string passed to PHP eval() inside js_to_php(), with the regex allow-list in evaluateFormula() only filtering alphanumeric tokens and leaving non-word punctuation characters intact. This makes it possible for unauthenticated attackers to execute code on the server. The only authentication barrier is a nonce check, but the required nonce is publicly emitted on every front-end page via the wp_head hook, making it freely obtainable by unauthenticated visitors. Payloads must be non-word XOR gadgets to bypass sanitization.CVE-2026-14805stylemixthemesconsulting - business, finance wordpress theme+11mo ago15-09-2026 13:03

The Consulting theme for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 6.7.16. This is due to a combination of two flaws: (1) the masterstudy_ms_stm_set_discard_transient AJAX endpoint in admin/admin-notices/classes/STMHandler.php accepts an arbitrary transient key without capability checks or nonce validation, and (2) the developer access login mechanism in admin/classes/stm-theme-support.php authenticates users based on a transient value without proper cryptographic validation when in legacy string mode. This makes it possible for authenticated attackers, with subscriber-level access and above, to set the stm_developer_access_token transient to a known value (1), then authenticate as any existing user including administrators by visiting a specially crafted URL, thereby achieving full privilege escalation to administrator.CVE-2026-39515stylemixthemesmotors+14mo ago15-06-2026 20:18

Subscriber Broken Access Control in Motors < 1.4.107 versions.CVE-2026-27433stylemixthemesmotors+13mo ago02-07-2026 11:14

Missing Authorization vulnerability in StylemixThemes Motors motors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a before 5.6.85.CVE-2026-27412stylemixthemespearl - corporate business+13mo ago02-07-2026 11:14

Unauthenticated Local File Inclusion in Pearl - Corporate Business <= 3.4.10 versions.CVE-2026-104399stylemixthemesmotors+115d ago06-10-2026 08:40

Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Motors allows Retrieve Embedded Sensitive Data. This issue affects Motors: from n/a through 1.4.124.CVE-2026-93950stylemixthemesmotors+111d ago10-10-2026 07:00

Missing Authorization vulnerability in StylemixThemes Motors motors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a through 1.4.108.CVE-2026-28145stylemixthemesmasterstudy_lms+12mo ago31-07-2026 13:19

Insufficient Verification of Data Authenticity vulnerability in StylemixThemes MasterStudy LMS allows Manipulating User State. This issue affects MasterStudy LMS: from n/a through 3.7.39.CVE-2026-8653stylemixthemesmasterstudy lms pro+14mo ago04-06-2026 01:26

The MasterStudy LMS Pro Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'columns' parameter in all versions up to, and including, 4.8.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with instructor-level access or above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.CVE-2026-97307stylemixthemescost_calculator_builder+117d ago04-10-2026 09:08

Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Cost Calculator Builder cost-calculator-builder allows Retrieve Embedded Sensitive Data.This issue affects Cost Calculator Builder: from n/a through 4.0.17.CVE-2023-40011stylemixthemescost_calculator_builder+11y ago13-12-2024 14:24

Missing Authorization vulnerability in StylemixThemes Cost Calculator Builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cost Calculator Builder: from n/a through 3.1.42.CVE-2023-2834stellarwpbookit — booking & appointment calendar+23y ago30-06-2023 01:56

The BookIt plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.3.7. This is due to insufficient verification on the user being supplied during booking an appointment through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.CVE-2023-4278stylemixthemesmasterstudy_lms+23y ago11-09-2023 19:46

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.0.18 does not have proper checks in place during registration allowing anyone to register on the site as an instructor. They can then add courses and/or posts.CVE-2023-37385stylemixthemesconsulting2y ago17-05-2024 06:47

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in StylemixThemes Consulting allows PHP Local File Inclusion.This issue affects Consulting: from n/a through 6.5.6.