Skip to content
OpenAdvisories

Vendor

StylemixThemes

75 known vulnerabilities.

Products

Motors 12 MasterStudy LMS Pro 7 uListing (WordPress plugin) 6 Cost Calculator Builder PRO 6 Consulting Elementor Widgets 6 MasterStudy LMS 6 Masterstudy Elementor Widgets 5 Motors – Car Dealer, Classifieds & Listing 3 Cost Calculator Builder 3 Consulting 2 MasterStudy LMS WordPress Plugin – for Online Courses and Education 2 Masterstudy 2 Motors - Car Dealer, Rental & Listing WordPress theme 2 eRoom – Zoom Meetings & Webinar (WordPress plugin) 2 Pearl - Corporate Business 2 Masterstudy - Education WordPress Theme 1 GDPR Compliance & Cookie Consent 1 eRoom – Zoom Meetings & Webinar 1 uListing 1 Splash - Sport Club WordPress Theme for Basketball, Football, Hockey 1 WordPress Header Builder Plugin – Pearl 1 Booking Calendar | Appointment Booking | BookIt 1 Masterstudy LMS Starter 1 Consulting - Business, Finance WordPress Theme 1 MegaMenu 1 Motors - Events 1
All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • Critical 9.3
    CVE-2026-115964

    WordPress Motors plugin <= 1.4.126 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Blind SQL Injection.This issue affects Motors: from n/a through 1.4.126.

    StylemixThemes Motors
  • Critical 9.3
    CVE-2026-62031

    WordPress uListing plugin <= 2.2.0 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes uListing ulisting allows Blind SQL Injection.This issue affects uListing: from n/a through 2.2.0.

    StylemixThemes uListing
  • Critical 9.8
    CVE-2026-14900 Public exploit

    Cost Calculator Builder PRO <= 4.0.3 - Unauthenticated Remote Code Execution via 'orderDetails' Parameter

    The Cost Calculator Builder PRO plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.0.3 via the js_to_php function. This is due to insufficient sanitization of the orderDetails[*].originalValue field, which is i…

    StylemixThemes Cost Calculator Builder PRO Web / CMS
  • Critical 9.3
    CVE-2026-54812

    WordPress Motors plugin <= 1.4.109 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Blind SQL Injection.This issue affects Motors: from n/a through 1.4.109.

    StylemixThemes Motors
  • Critical 9.9
    CVE-2025-64374

    WordPress Motors theme <= 5.6.81 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in StylemixThemes Motors motors allows Using Malicious Files.This issue affects Motors: from n/a through <= 5.6.81.

    StylemixThemes Motors
  • Critical 9.0
    CVE-2025-47586

    WordPress Motors - Events plugin <= 1.4.7 - Unauthenticated Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Motors - Events stm-motors-events allows PHP Local File Inclusion.This issue affects Motors - Events: from n/a through <= 1…

    StylemixThemes Motors - Events
  • Critical 9.8
    CVE-2025-4322 Public exploit Scanner template EPSS 15%

    Motors <= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover

    The Motors theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.6.67. This is due to the theme not properly validating a user's identity prior to updating their password. This makes it possible…

    StylemixThemes Motors - Car Dealer, Rental & Listing WordPress theme Web / CMS
  • Critical 9.3
    CVE-2024-43144 Scanner template

    WordPress Cost Calculator Builder plugin <= 3.2.15 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Cost Calculator Builder allows SQL Injection.This issue affects Cost Calculator Builder: from n/a through 3.2.15.

    StylemixThemes Cost Calculator Builder
  • Critical 9.9
    CVE-2024-37091

    WordPress Consulting Elementor Widgets plugin <= 1.3.0 - Remote Code Execution (RCE) vulnerability

    Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in StylemixThemes Consulting Elementor Widgets, StylemixThemes Masterstudy Elementor Widgets allows OS Command Injection.This issue affects Consulting Elementor …

    StylemixThemes Consulting Elementor Widgets Masterstudy Elementor Widgets
  • Critical 9.0
    CVE-2024-37089

    WordPress Consulting Elementor Widgets plugin <= 1.3.0 - Unauthenticated Local File Inclusion vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in StylemixThemes Consulting Elementor Widgets allows PHP Local File Inclusion.This issue affects Consulting Elementor Widgets: from n/a through 1.3.0.

    StylemixThemes Consulting Elementor Widgets
  • Critical 9.0
    CVE-2024-35677

    WordPress MegaMenu plugin <= 2.3.12 - Unauthenticated Local File Inclusion vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in StylemixThemes MegaMenu allows PHP Local File Inclusion.This issue affects MegaMenu: from n/a through 2.3.12.

    StylemixThemes MegaMenu
  • Critical 9.8
    CVE-2021-36879

    WordPress uListing plugin <= 2.0.5 - Unauthenticated Privilege Escalation vulnerability

    Unauthenticated Privilege Escalation vulnerability in WordPress uListing plugin (versions <= 2.0.5). Possible if WordPress configuration allows user registration.

    StylemixThemes uListing (WordPress plugin) Web / CMS