Log in Start free

Stylemix

Products

ProductCVEsExploitedLatest
Motors – Car Dealership & Classified Listings Plugin16–Nov 7, 2026
MasterStudy LMS15–Oct 30, 2026
Cost Calculator Builder13–Aug 5, 2026
Directory Listings WordPress plugin – uListing12–Mar 15, 2025
uListing11–Oct 10, 2026
MasterStudy LMS WordPress Plugin – for Online Courses and Education11–Jul 29, 2026
Motors5–Aug 13, 2026
Pearl – Header Builder3–Jan 9, 2025
MasterStudy LMS WordPress Plugin2–Oct 29, 2026
Pearl2–Apr 1, 2025
Checkout Custom Fields Builder for WooCommerce1–Sep 9, 2026

Exploited and recent CVEs

  • CVE-2026-116562 Medium 6.4 Motors <= 1.4.128 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Taxonomy Term Name via 'stm_f_s' Parameter –
  • CVE-2026-116617 High 8.1 Motors <= 1.4.128 - Authenticated (Subscriber+) File Deletion via 'stm_dealer_logo_path' Parameter 0.5%
  • CVE-2026-118090 High 8.8 WordPress MasterStudy LMS plugin <= 3.7.55 - PHP Object Injection vulnerability 0.4%
  • CVE-2026-80069 Medium 5.4 MasterStudy LMS WordPress Plugin < 3.7.50 Missing Authorization via stm_lms_send_test_email_ajax 0.4%
  • CVE-2026-80067 Medium 5.4 MasterStudy LMS WordPress Plugin < 3.7.50 Path Traversal via stm_lms_step Parameter 0.6%
  • CVE-2026-62033 High 7.6 WordPress uListing plugin <= 2.2.0 - Settings Change vulnerability 0.3%
  • CVE-2026-62031 Critical 9.3 WordPress uListing plugin <= 2.2.0 - SQL Injection vulnerability 0.3%
  • CVE-2026-96563 Medium 6.4 Motors <= 1.4.124 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'stm_f_s' Parameter 0.2%
  • CVE-2026-6806 High 7.5 Motors <= 1.4.109 - Unauthenticated Blind SQL Injection via 'stm_lat'/'stm_lng' Parameters 0.3%
  • CVE-2026-16750 Medium 5.3 Motors – Car Dealership & Classified Listings <= 1.4.120 - Missing Authorization to Unauthenticated Private/Draft/Password-Protected Listings Exposure 0.3%
  • CVE-2026-19802 Medium 4.3 Checkout Custom Fields Builder for WooCommerce <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation via 'plugin' Parameter 0.6%
  • CVE-2026-78284 High 8.6 WordPress MasterStudy LMS plugin <= 3.7.42 - Arbitrary File Deletion vulnerability 0.5%
  • CVE-2026-73404 Medium 6.5 WordPress MasterStudy LMS plugin <= 3.7.41 - Broken Access Control vulnerability 0.3%
  • CVE-2026-68568 Medium 6.3 WordPress MasterStudy LMS plugin <= 3.7.41 - Privilege Escalation vulnerability 0.3%
  • CVE-2026-66693 Medium 6.5 WordPress Motors plugin <= 1.4.113 - Broken Access Control vulnerability 0.3%
  • CVE-2026-7753 Medium 6.5 Cost Calculator Builder <= 3.6.17 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure 0.5%
  • CVE-2026-5060 Medium 6.5 MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.14 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Attachment Deletion 0.4%
  • CVE-2026-27392 Medium 4.3 WordPress uListing plugin <= 2.2.0 - Broken Access Control vulnerability 0.3%
  • CVE-2026-27391 Medium 5.4 WordPress uListing plugin <= 2.2.0 - Broken Access Control vulnerability 0.3%
  • CVE-2026-10865 Medium 5.3 Cost Calculator Builder <= 4.0.11 - Unauthenticated Sensitive Information Exposure of Payment Gateway Secret Keys 0.6%
  • CVE-2026-13114 High 7.2 Motors <= 1.4.112 - Unauthenticated Stored Cross-Site Scripting via Comment Content and User Biographical Info 0.4%
  • CVE-2026-12435 Medium 4.3 Motors <= 1.4.111 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'stm_mark_as_sold_car' Parameter 0.4%
  • CVE-2026-57330 Medium 6.5 WordPress MasterStudy LMS plugin <= 3.7.27 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-57640 Medium 4.3 WordPress MasterStudy LMS plugin <= 3.7.30 - Broken Access Control vulnerability 0.3%
  • CVE-2026-42730 High 8.5 WordPress MasterStudy LMS plugin <= 3.7.29 - SQL Injection vulnerability 0.3%
  • CVE-2026-3892 High 8.1 Motors – Car Dealer, Classifieds & Listing <= 1.4.107 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_dealer_logo_path' Parameter 0.3%
  • CVE-2025-14755 Medium 5.3 Cost Calculator Builder <= 4.0.1 - Unauthenticated Price Manipulation and Insecure Direct Object Reference 0.2%
  • CVE-2026-1934 Medium 4.3 Motors – Car Dealership & Classified Listings Plugin <= 1.4.103 - Missing Authorization to Authenticated (Subscriber+) Payment Bypass via 'stm_payment_status' Parameter 0.2%
  • CVE-2026-4817 Medium 6.5 MasterStudy LMS <= 3.7.25 - Authenticated (Subscriber+) Time-based Blind SQL Injection via 'order' and 'orderby' Parameters 0.5%
  • CVE-2026-28078 Medium 4.9 WordPress uListing plugin <= 2.2.0 - Arbitrary File Download vulnerability 0.4%