# cve.now: Stylemixthemes

The newest entries naming Stylemixthemes as an affected vendor (up to 200), of 73 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-66675](https://cve.now/CVE-2026-66675.md): WordPress Motors plugin \<= 1.4.128 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-123467](https://cve.now/CVE-2026-123467.md): WordPress Motors plugin \<= 1.4.128 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-123468](https://cve.now/CVE-2026-123468.md): WordPress Motors plugin \<= 1.4.128 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-119478](https://cve.now/CVE-2026-119478.md): WordPress MasterStudy LMS plugin \<= 3.7.56 - Content Injection vulnerability (CVSS 4.3)
- [CVE-2026-118092](https://cve.now/CVE-2026-118092.md): WordPress MasterStudy LMS plugin \<= 3.7.55 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-115964](https://cve.now/CVE-2026-115964.md): WordPress Motors plugin \<= 1.4.126 - SQL Injection vulnerability (CVSS 9.3)
- [CVE-2026-93950](https://cve.now/CVE-2026-93950.md): WordPress Motors theme \<= 1.4.108 - Broken Access Control vulnerability (CVSS 7.5)
- [CVE-2026-105079](https://cve.now/CVE-2026-105079.md): WordPress MasterStudy LMS plugin \<= 3.7.52 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-104399](https://cve.now/CVE-2026-104399.md): WordPress Motors plugin \<= 1.4.124 - Sensitive Data Exposure vulnerability (CVSS 6.9)
- [CVE-2026-97307](https://cve.now/CVE-2026-97307.md): WordPress Cost Calculator Builder plugin \<= 4.0.17 - Sensitive Data Exposure vulnerability (CVSS 7.5)
- [CVE-2026-14805](https://cve.now/CVE-2026-14805.md): Consulting - Business, Finance WordPress Theme \<= 6.7.16 - Authenticated (Subscriber+) Privilege Escalation via AJAX (CVSS 8.8)
- [CVE-2026-28145](https://cve.now/CVE-2026-28145.md): WordPress MasterStudy LMS plugin \<= 3.7.39 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-14900](https://cve.now/CVE-2026-14900.md): Cost Calculator Builder PRO \<= 4.0.3 - Unauthenticated Remote Code Execution via 'orderDetails' Parameter (CVSS 9.8)
- [CVE-2026-27433](https://cve.now/CVE-2026-27433.md): WordPress Motors theme \< 5.6.85 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2026-27412](https://cve.now/CVE-2026-27412.md): WordPress Pearl - Corporate Business theme \<= 3.4.10 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2025-68063](https://cve.now/CVE-2025-68063.md): WordPress Splash - Sport Club WordPress theme for Basketball, Football, Hockey theme \<= 4.4.3 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2026-54828](https://cve.now/CVE-2026-54828.md): WordPress Motors plugin \<= 1.4.109 - Broken Access Control vulnerability (CVSS 7.5)
- [CVE-2026-54812](https://cve.now/CVE-2026-54812.md): WordPress Motors plugin \<= 1.4.109 - SQL Injection vulnerability (CVSS 9.3)
- [CVE-2026-54814](https://cve.now/CVE-2026-54814.md): WordPress Motors plugin \<= 1.4.109 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2026-40766](https://cve.now/CVE-2026-40766.md): WordPress MasterStudy LMS plugin \<= 3.7.25 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2026-39515](https://cve.now/CVE-2026-39515.md): WordPress Motors plugin \< 1.4.107 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2025-64215](https://cve.now/CVE-2025-64215.md): WordPress MasterStudy LMS Pro plugin \< 4.7.16 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2026-8653](https://cve.now/CVE-2026-8653.md): MasterStudy LMS Pro Plus \<= 4.8.20 - Authenticated (Instructor+) SQL Injection via 'columns' Parameter (CVSS 6.5)
- [CVE-2025-64374](https://cve.now/CVE-2025-64374.md): WordPress Motors theme \<= 5.6.81 - Arbitrary File Upload vulnerability (CVSS 9.9)
- [CVE-2025-64214](https://cve.now/CVE-2025-64214.md): WordPress MasterStudy LMS Pro plugin \< 4.7.16 - Arbitrary Content Deletion vulnerability (CVSS 7.5)
- [CVE-2025-64213](https://cve.now/CVE-2025-64213.md): WordPress MasterStudy LMS Pro plugin \< 4.7.16 - Sensitive Data Exposure vulnerability (CVSS 7.5)
- [CVE-2025-64209](https://cve.now/CVE-2025-64209.md): WordPress Masterstudy theme \< 4.8.122 - Broken Access Control vulnerability (CVSS 7.5)
- [CVE-2025-64364](https://cve.now/CVE-2025-64364.md): WordPress Masterstudy theme \< 4.8.126 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2025-64361](https://cve.now/CVE-2025-64361.md): WordPress Consulting Elementor Widgets plugin \<= 1.4.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-64360](https://cve.now/CVE-2025-64360.md): WordPress Consulting Elementor Widgets plugin \<= 1.4.2 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2025-64359](https://cve.now/CVE-2025-64359.md): WordPress Consulting theme \< 6.7.5 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2025-64212](https://cve.now/CVE-2025-64212.md): WordPress MasterStudy LMS Pro plugin \< 4.7.16 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2025-64211](https://cve.now/CVE-2025-64211.md): WordPress Masterstudy Elementor Widgets plugin \<= 1.2.4 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2025-64210](https://cve.now/CVE-2025-64210.md): WordPress Masterstudy Elementor Widgets plugin \<= 1.2.4 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2025-7438](https://cve.now/CVE-2025-7438.md): MasterStudy LMS – Online Courses, eLearning PRO Plus \<= 4.7.9 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 7.5)
- [CVE-2025-47586](https://cve.now/CVE-2025-47586.md): WordPress Motors - Events plugin \<= 1.4.7 - Unauthenticated Local File Inclusion vulnerability (CVSS 9.0)
- [CVE-2025-4800](https://cve.now/CVE-2025-4800.md): MasterStudy LMS Pro \<= 4.7.0 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 8.8)
- [CVE-2025-4322](https://cve.now/CVE-2025-4322.md): Motors \<= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover (CVSS 9.8)
- [CVE-2024-13738](https://cve.now/CVE-2024-13738.md): Motors - Car Dealer, Rental & Listing WordPress theme \<= 5.6.65 - Unauthenticated Arbitrary Shortcode Execution (CVSS 7.3)
- [CVE-2025-26986](https://cve.now/CVE-2025-26986.md): WordPress Pearl Theme \< 3.4.8 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2024-11939](https://cve.now/CVE-2024-11939.md): Cost Calculator Builder PRO \<= 3.2.15 - Unauthenticated SQL Injection via data (CVSS 7.5)
- [CVE-2023-40011](https://cve.now/CVE-2023-40011.md): WordPress Cost Calculator Builder plugin \<= 3.1.42 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2022-43472](https://cve.now/CVE-2022-43472.md): WordPress eRoom plugin \<= 1.4.6 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2024-37269](https://cve.now/CVE-2024-37269.md): WordPress Masterstudy Elementor Widgets plugin \<= 1.2.2 - Unauthenticated Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2024-37094](https://cve.now/CVE-2024-37094.md): WordPress MasterStudy LMS plugin \<= 3.2.12 - Broken Access Control vulnerability (CVSS 8.2)
- [CVE-2024-43990](https://cve.now/CVE-2024-43990.md): WordPress Masterstudy LMS Starter theme \<= 1.1.8 - Sensitive Data Exposure vulnerability (CVSS 5.3)
- [CVE-2024-6010](https://cve.now/CVE-2024-6010.md): Cost Calculator Builder PRO \<= 3.2.1 - Unauthenticated Price Manipulation (CVSS 5.3)
- [CVE-2024-43144](https://cve.now/CVE-2024-43144.md): WordPress Cost Calculator Builder plugin \<= 3.2.15 - SQL Injection vulnerability (CVSS 9.3)
- [CVE-2024-37090](https://cve.now/CVE-2024-37090.md): SQL Injection vulnerability in multiple StylemixThemes premium themes (CVSS 8.5)
- [CVE-2024-37092](https://cve.now/CVE-2024-37092.md): WordPress Consulting Elementor Widgets plugin \<= 1.3.0 - Local File Inclusion vulnerability (CVSS 8.5)
- [CVE-2024-37091](https://cve.now/CVE-2024-37091.md): WordPress Consulting Elementor Widgets plugin \<= 1.3.0 - Remote Code Execution (RCE) vulnerability (CVSS 9.9)
- [CVE-2024-37089](https://cve.now/CVE-2024-37089.md): WordPress Consulting Elementor Widgets plugin \<= 1.3.0 - Unauthenticated Local File Inclusion vulnerability (CVSS 9.0)
- [CVE-2024-4787](https://cve.now/CVE-2024-4787.md): Cost Calculator Builder PRO \<= 3.1.75 - Unauthenticated Arbitrary Email Sending (CVSS 5.8)
- [CVE-2024-35677](https://cve.now/CVE-2024-35677.md): WordPress MegaMenu plugin \<= 2.3.12 - Unauthenticated Local File Inclusion vulnerability (CVSS 9.0)
- [CVE-2024-4789](https://cve.now/CVE-2024-4789.md): Cost Calculator Builder Pro \<= 3.1.72 - Authenticated (Subscriber+) Server-Side Request Forgery (CVSS 6.4)
- [CVE-2023-37385](https://cve.now/CVE-2023-37385.md): WordPress Consulting theme \<= 6.5.6 - Local File Inclusion (CVSS 7.3)
- [CVE-2024-4097](https://cve.now/CVE-2024-4097.md): Cost Calculator Builder Pro \<= 3.1.67 - Unauthenticated Cross-Site Scripting via SVG Upload (CVSS 7.2)
- [CVE-2023-50852](https://cve.now/CVE-2023-50852.md): WordPress BookIt Plugin \<= 2.4.3 is vulnerable to SQL Injection (CVSS 7.6)
- [CVE-2023-46207](https://cve.now/CVE-2023-46207.md): WordPress Motors – Car Dealer & Classified Ads Plugin \<= 1.4.6 is vulnerable to Server Side Request Forgery (SSRF) (CVSS 4.1)
- [CVE-2023-46208](https://cve.now/CVE-2023-46208.md): WordPress Motors – Car Dealer & Classified Ads Plugin \<= 1.4.6 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1)
- [CVE-2023-35093](https://cve.now/CVE-2023-35093.md): WordPress MasterStudy LMS Plugin \<= 3.0.8 is vulnerable to Broken Access Control (CVSS 6.5)
- [CVE-2023-35090](https://cve.now/CVE-2023-35090.md): WordPress MasterStudy LMS Plugin \<= 3.0.8 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5)
- [CVE-2022-45815](https://cve.now/CVE-2022-45815.md): WordPress GDPR Compliance & Cookie Consent Plugin \<= 1.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3)
- [CVE-2022-38716](https://cve.now/CVE-2022-38716.md): WordPress Motors – Car Dealer & Classified Ads Plugin \<= 1.4.4 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4)
- [CVE-2022-38356](https://cve.now/CVE-2022-38356.md): WordPress Pearl Plugin \<= 1.3.4 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4)
- [CVE-2022-25614](https://cve.now/CVE-2022-25614.md): WordPress eRoom plugin \<= 1.3.7 - Cross-Site Request Forgery (CSRF) leading to Sync with Zoom Meetings vulnerability (CVSS 4.3)
- [CVE-2022-25615](https://cve.now/CVE-2022-25615.md): WordPress eRoom plugin \<= 1.3.8 - Cross-Site Request Forgery (CSRF) vulnerability leading to Cache Deletion (CVSS 4.3)
- [CVE-2021-36880](https://cve.now/CVE-2021-36880.md): WordPress uListing plugin \<= 2.0.3 - Unauthenticated SQL Injection (SQLi) vulnerability (CVSS 8.6)
- [CVE-2021-36874](https://cve.now/CVE-2021-36874.md): WordPress uListing plugin \<= 2.0.5 - Authenticated Insecure Direct Object References (IDOR) vulnerability (CVSS 7.1)
- [CVE-2021-36877](https://cve.now/CVE-2021-36877.md): WordPress uListing plugin \<= 2.0.5 - Modify User Roles via Cross-Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2021-36876](https://cve.now/CVE-2021-36876.md): WordPress uListing plugin \<= 2.0.5 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities (CVSS 5.4)
- [CVE-2021-36879](https://cve.now/CVE-2021-36879.md): WordPress uListing plugin \<= 2.0.5 - Unauthenticated Privilege Escalation vulnerability (CVSS 9.8)
- [CVE-2021-36878](https://cve.now/CVE-2021-36878.md): WordPress uListing plugin \<= 2.0.5 - Settings Update via Cross-Site Request Forgery (CSRF) vulnerability (CVSS 4.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/stylemixthemes
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.