# cve.now: Stylemix

The newest entries naming Stylemix as an affected vendor (up to 200), of 92 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-104746](https://cve.now/CVE-2026-104746.md): Motors \<= 1.4.125 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm\_user\_avatar\_path' User Meta (CVSS 8.1)
- [CVE-2026-116562](https://cve.now/CVE-2026-116562.md): Motors \<= 1.4.128 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Taxonomy Term Name via 'stm\_f\_s' Parameter (CVSS 6.4)
- [CVE-2026-116617](https://cve.now/CVE-2026-116617.md): Motors \<= 1.4.128 - Authenticated (Subscriber+) File Deletion via 'stm\_dealer\_logo\_path' Parameter (CVSS 8.1)
- [CVE-2026-118090](https://cve.now/CVE-2026-118090.md): WordPress MasterStudy LMS plugin \<= 3.7.55 - PHP Object Injection vulnerability (CVSS 8.8)
- [CVE-2026-80069](https://cve.now/CVE-2026-80069.md): MasterStudy LMS WordPress Plugin \< 3.7.50 Missing Authorization via stm\_lms\_send\_test\_email\_ajax (CVSS 5.3)
- [CVE-2026-80067](https://cve.now/CVE-2026-80067.md): MasterStudy LMS WordPress Plugin \< 3.7.50 Path Traversal via stm\_lms\_step Parameter (CVSS 5.3)
- [CVE-2026-62033](https://cve.now/CVE-2026-62033.md): WordPress uListing plugin \<= 2.2.0 - Settings Change vulnerability (CVSS 7.6)
- [CVE-2026-62031](https://cve.now/CVE-2026-62031.md): WordPress uListing plugin \<= 2.2.0 - SQL Injection vulnerability (CVSS 9.3)
- [CVE-2026-96563](https://cve.now/CVE-2026-96563.md): Motors \<= 1.4.124 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'stm\_f\_s' Parameter (CVSS 6.4)
- [CVE-2026-6806](https://cve.now/CVE-2026-6806.md): Motors \<= 1.4.109 - Unauthenticated Blind SQL Injection via 'stm\_lat'/'stm\_lng' Parameters (CVSS 7.5)
- [CVE-2026-16750](https://cve.now/CVE-2026-16750.md): Motors – Car Dealership & Classified Listings \<= 1.4.120 - Missing Authorization to Unauthenticated Private/Draft/Password-Protected Listings Exposure (CVSS 5.3)
- [CVE-2026-19802](https://cve.now/CVE-2026-19802.md): Checkout Custom Fields Builder for WooCommerce \<= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation via 'plugin' Parameter (CVSS 4.3)
- [CVE-2026-78284](https://cve.now/CVE-2026-78284.md): WordPress MasterStudy LMS plugin \<= 3.7.42 - Arbitrary File Deletion vulnerability (CVSS 8.6)
- [CVE-2026-73404](https://cve.now/CVE-2026-73404.md): WordPress MasterStudy LMS plugin \<= 3.7.41 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2026-68568](https://cve.now/CVE-2026-68568.md): WordPress MasterStudy LMS plugin \<= 3.7.41 - Privilege Escalation vulnerability (CVSS 6.3)
- [CVE-2026-66693](https://cve.now/CVE-2026-66693.md): WordPress Motors plugin \<= 1.4.113 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2026-7753](https://cve.now/CVE-2026-7753.md): Cost Calculator Builder \<= 3.6.17 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure (CVSS 6.5)
- [CVE-2026-5060](https://cve.now/CVE-2026-5060.md): MasterStudy LMS WordPress Plugin – for Online Courses and Education \<= 3.7.14 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Attachment Deletion (CVSS 6.5)
- [CVE-2026-27392](https://cve.now/CVE-2026-27392.md): WordPress uListing plugin \<= 2.2.0 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-27391](https://cve.now/CVE-2026-27391.md): WordPress uListing plugin \<= 2.2.0 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2026-10865](https://cve.now/CVE-2026-10865.md): Cost Calculator Builder \<= 4.0.11 - Unauthenticated Sensitive Information Exposure of Payment Gateway Secret Keys (CVSS 5.3)
- [CVE-2026-13114](https://cve.now/CVE-2026-13114.md): Motors \<= 1.4.112 - Unauthenticated Stored Cross-Site Scripting via Comment Content and User Biographical Info (CVSS 7.2)
- [CVE-2026-12435](https://cve.now/CVE-2026-12435.md): Motors \<= 1.4.111 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'stm\_mark\_as\_sold\_car' Parameter (CVSS 4.3)
- [CVE-2026-57330](https://cve.now/CVE-2026-57330.md): WordPress MasterStudy LMS plugin \<= 3.7.27 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-57640](https://cve.now/CVE-2026-57640.md): WordPress MasterStudy LMS plugin \<= 3.7.30 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-42730](https://cve.now/CVE-2026-42730.md): WordPress MasterStudy LMS plugin \<= 3.7.29 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2026-3892](https://cve.now/CVE-2026-3892.md): Motors – Car Dealer, Classifieds & Listing \<= 1.4.107 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm\_dealer\_logo\_path' Parameter (CVSS 8.1)
- [CVE-2025-14755](https://cve.now/CVE-2025-14755.md): Cost Calculator Builder \<= 4.0.1 - Unauthenticated Price Manipulation and Insecure Direct Object Reference (CVSS 5.3)
- [CVE-2026-1934](https://cve.now/CVE-2026-1934.md): Motors – Car Dealership & Classified Listings Plugin \<= 1.4.103 - Missing Authorization to Authenticated (Subscriber+) Payment Bypass via 'stm\_payment\_status' Parameter (CVSS 4.3)
- [CVE-2026-4817](https://cve.now/CVE-2026-4817.md): MasterStudy LMS \<= 3.7.25 - Authenticated (Subscriber+) Time-based Blind SQL Injection via 'order' and 'orderby' Parameters (CVSS 6.5)
- [CVE-2026-28078](https://cve.now/CVE-2026-28078.md): WordPress uListing plugin \<= 2.2.0 - Arbitrary File Download vulnerability (CVSS 4.9)
- [CVE-2026-28138](https://cve.now/CVE-2026-28138.md): WordPress uListing plugin \<= 2.2.0 - PHP Object Injection vulnerability (CVSS 7.2)
- [CVE-2026-0559](https://cve.now/CVE-2026-0559.md): MasterStudy LMS WordPress Plugin – for Online Courses and Education \<= 3.7.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'stm\_lms\_courses\_grid\_display' Shortcode (CVSS 6.4)
- [CVE-2025-14757](https://cve.now/CVE-2025-14757.md): Cost Calculator Builder \<= 3.6.9 - Missing Authorization to Unauthenticated Payment Status Bypass (CVSS 5.3)
- [CVE-2025-13766](https://cve.now/CVE-2025-13766.md): MasterStudy LMS WordPress Plugin – for Online Courses and Education \<= 3.7.6 Missing Authorization to Authenticated (Subscriber+) Posts and Media Creation, Modification and Deletion (CVSS 5.4)
- [CVE-2025-12529](https://cve.now/CVE-2025-12529.md): Cost Calculator Builder \<= 3.6.3 - Unauthenticated Arbitrary File Deletion (CVSS 8.8)
- [CVE-2025-62049](https://cve.now/CVE-2025-62049.md): WordPress Cost Calculator Builder plugin \<= 3.5.32 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2025-64366](https://cve.now/CVE-2025-64366.md): WordPress MasterStudy LMS plugin \<= 3.6.27 - SQL Injection vulnerability (CVSS 7.6)
- [CVE-2025-59575](https://cve.now/CVE-2025-59575.md): WordPress MasterStudy LMS plugin \<= 3.6.20 - Sensitive Data Exposure vulnerability (CVSS 4.9)
- [CVE-2025-10494](https://cve.now/CVE-2025-10494.md): Motors – Car Dealership & Classified Listings Plugin \<= 1.4.89 - Authenticated (Subscriber+) Arbitrary File Deletion (CVSS 8.1)
- [CVE-2025-9243](https://cve.now/CVE-2025-9243.md): Cost Calculator Builder \<= 3.5.32 - Authenticated (Subscriber+) Missing Authorization via get\_cc\_orders/update\_order\_status Functions (CVSS 8.1)
- [CVE-2025-59576](https://cve.now/CVE-2025-59576.md): WordPress MasterStudy LMS Plugin \<= 3.6.20 - Broken Access Control Vulnerability (CVSS 6.5)
- [CVE-2025-59577](https://cve.now/CVE-2025-59577.md): WordPress MasterStudy LMS Plugin \<= 3.6.20 - Race Condition Vulnerability (CVSS 4.3)
- [CVE-2025-54744](https://cve.now/CVE-2025-54744.md): WordPress MasterStudy LMS plugin \<= 3.6.15 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2025-54691](https://cve.now/CVE-2025-54691.md): WordPress Motors Plugin plugin \<= 1.4.80 - Insecure Direct Object References (IDOR) Vulnerability (CVSS 5.3)
- [CVE-2025-48277](https://cve.now/CVE-2025-48277.md): WordPress Cost Calculator Builder plugin \<= 3.2.74 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9)
- [CVE-2025-32662](https://cve.now/CVE-2025-32662.md): WordPress uListing plugin \<= 2.2.0 - Deserialization of untrusted data vulnerability (CVSS 8.8)
- [CVE-2025-39587](https://cve.now/CVE-2025-39587.md): WordPress Cost Calculator Builder plugin \<= 3.2.65 - SQL Injection Vulnerability (CVSS 9.3)
- [CVE-2025-2128](https://cve.now/CVE-2025-2128.md): Cost Calculator Builder \<= 3.2.67 - Authenticated (Subscriber+) SQL Injection via order\_ids Parameter (CVSS 6.5)
- [CVE-2025-32654](https://cve.now/CVE-2025-32654.md): WordPress Motors plugin \<= 1.4.71 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2025-3437](https://cve.now/CVE-2025-3437.md): Motors – Car Dealership & Classified Listings Plugin \<= 1.4.66 - Missing Authorization to Authenticated (Subscriber+) Wizard Set-up (CVSS 4.3)
- [CVE-2025-2808](https://cve.now/CVE-2025-2808.md): Motors – Car Dealership & Classified Listings Plugin \<= 1.4.63 - Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 5.4)
- [CVE-2025-2807](https://cve.now/CVE-2025-2807.md): Motors – Car Dealership & Classified Listings Plugin \<= 1.4.64 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation (CVSS 8.8)
- [CVE-2025-32237](https://cve.now/CVE-2025-32237.md): WordPress MasterStudy LMS plugin \<= 3.5.28 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2025-32170](https://cve.now/CVE-2025-32170.md): WordPress Motors plugin \<= 1.4.71 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-32142](https://cve.now/CVE-2025-32142.md): WordPress Motors plugin \<= 1.4.71 - Local File Inclusion vulnerability (CVSS 8.8)
- [CVE-2025-32141](https://cve.now/CVE-2025-32141.md): WordPress MasterStudy LMS plugin \<= 3.5.28 - Local File Inclusion vulnerability (CVSS 8.8)
- [CVE-2025-32122](https://cve.now/CVE-2025-32122.md): WordPress uListing plugin \<= 2.2.0 - SQL Injection vulnerability (CVSS 7.6)
- [CVE-2025-31881](https://cve.now/CVE-2025-31881.md): WordPress Pearl plugin \<= 1.3.9 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2025-31880](https://cve.now/CVE-2025-31880.md): WordPress Pearl plugin \<= 1.3.9 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2025-31414](https://cve.now/CVE-2025-31414.md): WordPress Cost Calculator Builder plugin \<= 3.2.65 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-13737](https://cve.now/CVE-2024-13737.md): Motors – Car Dealer, Classifieds & Listing \<= 1.4.57 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion and Listing Template Creation (CVSS 4.3)
- [CVE-2025-1653](https://cve.now/CVE-2025-1653.md): Directory Listings WordPress plugin – uListing \<= 2.2.0 - Authenticated (Subscriber+) Privilege Escalation (CVSS 8.8)
- [CVE-2025-1657](https://cve.now/CVE-2025-1657.md): Directory Listings WordPress plugin – uListing \<= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Update and PHP Object Injection (CVSS 8.8)
- [CVE-2025-25150](https://cve.now/CVE-2025-25150.md): WordPress uListing plugin \<= 2.1.6 - SQL Injection vulnerability (CVSS 9.3)
- [CVE-2025-25151](https://cve.now/CVE-2025-25151.md): WordPress uListing Plugin \<= 2.1.6 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2024-10970](https://cve.now/CVE-2024-10970.md): Motors – Car Dealer, Classifieds & Listing \<= 1.4.43 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Custom Title (CVSS 5.4)
- [CVE-2024-12206](https://cve.now/CVE-2024-12206.md): Wordpress Header Builder Plugin \<= 1.3.8 - Cross-Site Request Forgery to Header Deletion (CVSS 4.3)
- [CVE-2024-37093](https://cve.now/CVE-2024-37093.md): WordPress MasterStudy LMS plugin \<= 3.2.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2024-47344](https://cve.now/CVE-2024-47344.md): WordPress uListing plugin \<= 2.1.5 - Sensitive Data Exposure vulnerability (CVSS 5.3)
- [CVE-2024-6012](https://cve.now/CVE-2024-6012.md): Cost Calculator Builder \<= 3.2.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Creation (CVSS 4.3)
- [CVE-2024-6011](https://cve.now/CVE-2024-6011.md): Cost Calculator Builder \<= 3.2.12 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4)
- [CVE-2024-5545](https://cve.now/CVE-2024-5545.md): Motors – Car Dealer, Classifieds & Listing \<= 1.4.9 - Missing Authorization (CVSS 5.3)
- [CVE-2024-5468](https://cve.now/CVE-2024-5468.md): WordPress Header Builder Plugin – Pearl \<= 1.3.7 - Missing Authorization to Unauthenticated Arbitrary Site Options Deletion (CVSS 6.5)
- [CVE-2024-4000](https://cve.now/CVE-2024-4000.md): WordPress Header Builder Plugin – Pearl \<= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4)
- [CVE-2024-3942](https://cve.now/CVE-2024-3942.md): MasterStudy LMS WordPress Plugin – for Online Courses and Education \<= 3.3.8 - Missing Authorization (CVSS 6.3)
- [CVE-2024-3136](https://cve.now/CVE-2024-3136.md): MasterStudy LMS \<= 3.3.3 - Unauthenticated Local File Inclusion via template (CVSS 9.8)
- [CVE-2024-1904](https://cve.now/CVE-2024-1904.md): MasterStudy LMS \<= 3.2.13 - Missing Authorization to Sensitive Information Exposure in search\_posts (CVSS 4.3)
- [CVE-2024-2411](https://cve.now/CVE-2024-2411.md): MasterStudy LMS \<= 3.3.0 - Unauthenticated Local File Inclusion via modal (CVSS 9.8)
- [CVE-2024-2409](https://cve.now/CVE-2024-2409.md): MasterStudy LMS \<= 3.3.1 - Unauthenticated Privilege Escalation via stm\_lms\_register AJAX Action (CVSS 9.8)
- [CVE-2024-2106](https://cve.now/CVE-2024-2106.md): MasterStudy LMS WordPress Plugin – for Online Courses and Education \<= 3.2.10 - Basic Information Exposure via REST route (CVSS 5.3)
- [CVE-2024-1512](https://cve.now/CVE-2024-1512.md): MasterStudy LMS WordPress Plugin – for Online Courses and Education \<= 3.2.5 - Unauthenticated SQL Injection (CVSS 9.8)
- [CVE-2021-4381](https://cve.now/CVE-2021-4381.md): uListing \<= 1.6.6 - Unauthenticated Options Changes via wp\_route (CVSS 9.8)
- [CVE-2021-4370](https://cve.now/CVE-2021-4370.md): uListing \<= 1.6.6 - Missing Authorization (CVSS 9.8)
- [CVE-2021-4357](https://cve.now/CVE-2021-4357.md): uListing \<= 1.6.6 - Unauthenticated Arbitrary Post/Page Deletion (CVSS 9.1)
- [CVE-2021-4345](https://cve.now/CVE-2021-4345.md): uListing \<= 1.6.6 - Unauthenticated Arbitrary Roles and Capabilities Creation/Deletion (CVSS 6.5)
- [CVE-2021-4346](https://cve.now/CVE-2021-4346.md): uListing \<= 1.6.6 - Unauthenticated Arbitrary Account Changes (CVSS 9.8)
- [CVE-2021-4343](https://cve.now/CVE-2021-4343.md): uListing \<= 1.6.6 - Unauthenticated Arbitrary Account Creation (CVSS 9.8)
- [CVE-2021-4341](https://cve.now/CVE-2021-4341.md): uListing \<= 1.6.6 - Unauthenticated Wordpress Options Changes via AJAX (CVSS 9.8)
- [CVE-2021-4340](https://cve.now/CVE-2021-4340.md): uListing \<= 1.6.6 - Unauthenticated SQL Injection (CVSS 9.8)
- [CVE-2021-4339](https://cve.now/CVE-2021-4339.md): uListing \<= 1.6.6 - Unauthenticated Information Disclosure (CVSS 7.5)
- [CVE-2021-36875](https://cve.now/CVE-2021-36875.md): WordPress uListing plugin \<= 2.0.5 - Auth. Reflected Cross-Site Scripting (XSS) vulnerability (CVSS 5.9)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/stylemix
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.