Stylemix vulnerabilities
92 CVEs and advisories name Stylemix as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-104746Motors <= 1.4.125 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_user_avatar_path' User Meta
- CVE-2026-116562Motors <= 1.4.128 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Taxonomy Term Name via 'stm_f_s' Parameter
- CVE-2026-116617Motors <= 1.4.128 - Authenticated (Subscriber+) File Deletion via 'stm_dealer_logo_path' Parameter
- CVE-2026-118090WordPress MasterStudy LMS plugin <= 3.7.55 - PHP Object Injection vulnerability
- CVE-2026-80069MasterStudy LMS WordPress Plugin < 3.7.50 Missing Authorization via stm_lms_send_test_email_ajax
- CVE-2026-80067MasterStudy LMS WordPress Plugin < 3.7.50 Path Traversal via stm_lms_step Parameter
- CVE-2026-62033WordPress uListing plugin <= 2.2.0 - Settings Change vulnerability
- CVE-2026-62031WordPress uListing plugin <= 2.2.0 - SQL Injection vulnerability
- CVE-2026-96563Motors <= 1.4.124 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'stm_f_s' Parameter
- CVE-2026-6806Motors <= 1.4.109 - Unauthenticated Blind SQL Injection via 'stm_lat'/'stm_lng' Parameters
- CVE-2026-16750Motors – Car Dealership & Classified Listings <= 1.4.120 - Missing Authorization to Unauthenticated Private/Draft/Password-Protected Listings Exposure
- CVE-2026-19802Checkout Custom Fields Builder for WooCommerce <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation via 'plugin' Parameter
- CVE-2026-78284WordPress MasterStudy LMS plugin <= 3.7.42 - Arbitrary File Deletion vulnerability
- CVE-2026-73404WordPress MasterStudy LMS plugin <= 3.7.41 - Broken Access Control vulnerability
- CVE-2026-68568WordPress MasterStudy LMS plugin <= 3.7.41 - Privilege Escalation vulnerability
- CVE-2026-66693WordPress Motors plugin <= 1.4.113 - Broken Access Control vulnerability
- CVE-2026-7753Cost Calculator Builder <= 3.6.17 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure
- CVE-2026-5060MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.14 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Attachment Deletion
- CVE-2026-27392WordPress uListing plugin <= 2.2.0 - Broken Access Control vulnerability
- CVE-2026-27391WordPress uListing plugin <= 2.2.0 - Broken Access Control vulnerability
- CVE-2026-10865Cost Calculator Builder <= 4.0.11 - Unauthenticated Sensitive Information Exposure of Payment Gateway Secret Keys
- CVE-2026-13114Motors <= 1.4.112 - Unauthenticated Stored Cross-Site Scripting via Comment Content and User Biographical Info
- CVE-2026-12435Motors <= 1.4.111 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'stm_mark_as_sold_car' Parameter
- CVE-2026-57330WordPress MasterStudy LMS plugin <= 3.7.27 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57640WordPress MasterStudy LMS plugin <= 3.7.30 - Broken Access Control vulnerability
- CVE-2026-42730WordPress MasterStudy LMS plugin <= 3.7.29 - SQL Injection vulnerability
- CVE-2026-3892Motors – Car Dealer, Classifieds & Listing <= 1.4.107 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_dealer_logo_path' Parameter
- CVE-2025-14755Cost Calculator Builder <= 4.0.1 - Unauthenticated Price Manipulation and Insecure Direct Object Reference
- CVE-2026-1934Motors – Car Dealership & Classified Listings Plugin <= 1.4.103 - Missing Authorization to Authenticated (Subscriber+) Payment Bypass via 'stm_payment_status' Parameter
- CVE-2026-4817MasterStudy LMS <= 3.7.25 - Authenticated (Subscriber+) Time-based Blind SQL Injection via 'order' and 'orderby' Parameters