CVE Intelligence

StylemixThemes vulnerabilities

🔔 Create alert RSS

Published CVEs affecting StylemixThemes products: 26 record(s), with severity, exploitation and fixes.

Motors 8MasterStudy LMS Pro 5Cost Calculator Builder 2Consulting Elementor Widgets 2Masterstudy 2MasterStudy LMS 2Masterstudy Elementor Widgets 2Consulting 1Splash - Sport Club WordPress Theme for Basketball, Football, Hockey 1Pearl - Corporate Business 1

Exploited only (KEV) →

CVE-2026-93950 High · 7.5 CWE-862 Oct 10, 2026
WordPress Motors theme <= 1.4.108 - Broken Access Control vulnerability
Missing Authorization vulnerability in StylemixThemes Motors motors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a through 1.4.108.
CVE-2026-105079 Medium · 6.5 CWE-79 Oct 8, 2026
WordPress MasterStudy LMS plugin <= 3.7.52 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-management-system allows Stored XSS.This issue affects MasterStudy LMS: from n/a through 3.7.52.
CVE-2026-104399 Medium · 6.9 CWE-201 Oct 6, 2026
WordPress Motors plugin <= 1.4.124 - Sensitive Data Exposure vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Motors allows Retrieve Embedded Sensitive Data. This issue affects Motors: from n/a through 1.4.124.
CVE-2026-97307 High · 7.5 CWE-201 Oct 4, 2026
WordPress Cost Calculator Builder plugin <= 4.0.17 - Sensitive Data Exposure vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Cost Calculator Builder cost-calculator-builder allows Retrieve Embedded Sensitive Data.This issue affects Cost Calculator Builder: from n/a through 4.0.17.
CVE-2026-27433 Medium · 6.5 CWE-862 Jul 2, 2026
WordPress Motors theme <= 5.6.80 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Motors <= 5.6.80 versions.
CVE-2026-27412 High · 8.1 CWE-98 Jul 2, 2026
WordPress Pearl - Corporate Business theme <= 3.4.10 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Pearl - Corporate Business <= 3.4.10 versions.
CVE-2025-68063 High · 7.5 CWE-98 Jun 26, 2026
WordPress Splash - Sport Club WordPress theme for Basketball, Football, Hockey theme <= 4.4.3 - Local File Inclusion vulnerability
Contributor Local File Inclusion in Splash - Sport Club WordPress Theme for Basketball, Football, Hockey <= 4.4.3 versions.
CVE-2026-54828 High · 7.5 CWE-862 Jun 25, 2026
WordPress Motors plugin <= 1.4.109 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Motors <= 1.4.109 versions.
CVE-2026-54812 Critical · 9.3 CWE-89 Jun 17, 2026
WordPress Motors plugin <= 1.4.109 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Blind SQL Injection.This issue affects Motors: from n/a through 1.4.109.
CVE-2026-54814 High · 8.1 CWE-98 Jun 17, 2026
WordPress Motors plugin <= 1.4.109 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Motors allows PHP Local File Inclusion. This issue affects Motors: from n/a through 1.4.109.
CVE-2026-40766 High · 8.5 CWE-89 Jun 15, 2026
WordPress MasterStudy LMS plugin <= 3.7.25 - SQL Injection vulnerability
Subscriber SQL Injection in MasterStudy LMS <= 3.7.25 versions.
CVE-2026-39515 Medium · 6.5 CWE-862 Jun 15, 2026
WordPress Motors plugin < 1.4.107 - Broken Access Control vulnerability
Subscriber Broken Access Control in Motors < 1.4.107 versions.
CVE-2025-64215 Medium · 6.5 CWE-862 Jun 15, 2026
WordPress MasterStudy LMS Pro plugin < 4.7.16 - Broken Access Control vulnerability
Missing Authorization vulnerability in StylemixThemes MasterStudy LMS Pro allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects MasterStudy LMS Pro: from n/a before 4.7.16.
CVE-2026-8653 Medium · 6.5 CWE-89 Jun 3, 2026
MasterStudy LMS Pro Plus <= 4.8.20 - Authenticated (Instructor+) SQL Injection via 'columns' Parameter
The MasterStudy LMS Pro Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'columns' parameter in all versions up to, and including, 4.8.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with instructor-level access or above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVE-2025-14757 Medium · 5.3 CWE-862 Jan 16, 2026
Cost Calculator Builder <= 3.6.9 - Missing Authorization to Unauthenticated Payment Status Bypass
The Cost Calculator Builder plugin for WordPress is vulnerable to Unauthenticated Payment Status Bypass in all versions up to, and including, 3.6.9 only when used in combination with Cost Calculator Builder PRO. This is due to the complete_payment AJAX action being registered via wp_ajax_nopriv, making it accessible to unauthenticated users, and the complete() function only verifying a nonce without checking user capabilities or order ownership. Since nonces are exposed to all visitors via window.ccb_nonces in the page source, any unauthenticated attacker can mark any order's payment status as "completed" without actual payment.
CVE-2025-64374 Critical · 9.9 CWE-434 Dec 18, 2025
WordPress Motors theme <= 5.6.81 - Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in StylemixThemes Motors motors allows Using Malicious Files.This issue affects Motors: from n/a through <= 5.6.81.
CVE-2025-64214 High · 7.5 CWE-862 Dec 18, 2025
WordPress MasterStudy LMS Pro plugin < 4.7.16 - Arbitrary Content Deletion vulnerability
Missing Authorization vulnerability in StylemixThemes MasterStudy LMS Pro masterstudy-lms-learning-management-system-pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects MasterStudy LMS Pro: from n/a through < 4.7.16.
CVE-2025-64213 High · 7.5 CWE-201 Dec 18, 2025
WordPress MasterStudy LMS Pro plugin < 4.7.16 - Sensitive Data Exposure vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes MasterStudy LMS Pro masterstudy-lms-learning-management-system-pro allows Retrieve Embedded Sensitive Data.This issue affects MasterStudy LMS Pro: from n/a through < 4.7.16.
CVE-2025-64209 High · 7.5 CWE-862 Dec 18, 2025
WordPress Masterstudy theme < 4.8.122 - Broken Access Control vulnerability
Missing Authorization vulnerability in StylemixThemes Masterstudy masterstudy allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Masterstudy: from n/a through < 4.8.122.
CVE-2025-64364 High · 7.5 CWE-98 Oct 31, 2025
WordPress Masterstudy theme < 4.8.126 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Masterstudy masterstudy allows PHP Local File Inclusion.This issue affects Masterstudy: from n/a through < 4.8.126.
CVE-2025-64361 Medium · 6.5 CWE-79 Oct 31, 2025
WordPress Consulting Elementor Widgets plugin <= 1.4.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StylemixThemes Consulting Elementor Widgets consulting-elementor-widgets allows DOM-Based XSS.This issue affects Consulting Elementor Widgets: from n/a through <= 1.4.2.
CVE-2025-64360 High · 7.5 CWE-98 Oct 31, 2025
WordPress Consulting Elementor Widgets plugin <= 1.4.2 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Consulting Elementor Widgets consulting-elementor-widgets allows PHP Local File Inclusion.This issue affects Consulting Elementor Widgets: from n/a through <= 1.4.2.
CVE-2025-64359 High · 7.5 CWE-98 Oct 31, 2025
WordPress Consulting theme < 6.7.5 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Consulting consulting allows PHP Local File Inclusion.This issue affects Consulting: from n/a through < 6.7.5.
CVE-2025-64212 Medium · 5.4 CWE-862 Oct 29, 2025
WordPress MasterStudy LMS Pro plugin < 4.7.16 - Broken Access Control vulnerability
Missing Authorization vulnerability in StylemixThemes MasterStudy LMS Pro masterstudy-lms-learning-management-system-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MasterStudy LMS Pro: from n/a through < 4.7.16.
CVE-2025-64211 Medium · 5.3 CWE-862 Oct 29, 2025
WordPress Masterstudy Elementor Widgets plugin <= 1.2.4 - Broken Access Control vulnerability
Missing Authorization vulnerability in StylemixThemes Masterstudy Elementor Widgets masterstudy-elementor-widgets allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Masterstudy Elementor Widgets: from n/a through <= 1.2.4.