Threat database

Contributor Broken Access Control in uListing <= 2.2.0 versions.

Subscriber Broken Access Control in uListing <= 2.2.0 versions.

The Cost Calculator Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.11 via the (template body). This makes it possible for unauthenticated attackers to extract the plaintext Stripe secret key, Razorpay secret key, and PayPal client_secret embedded in the page source of any page containing a calculator, enabling full control of the merchant's payment gateway accounts. This exposure only occurs when the 'use in all calculators' option is enabled for one or more payment gateways in the plugin's global settings.

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content and User Biographical Info in all versions up to, and including, 1.4.112 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Missing Authorization vulnerability in StylemixThemes Motors motors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a before 5.6.85.

Unauthenticated Local File Inclusion in Pearl - Corporate Business <= 3.4.10 versions.

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.111. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to mark or unmark any other user's car listing as sold by replaying a valid nonce harvested from their own listing against an arbitrary victim post ID, triggering a site-wide 'Sold' badge on the victim's listing and silently stripping its special_car featured post meta as a side effect. Exploitation requires the attacker to hold an active listing of their own (obtainable by a Subscriber via the plugin's add-listing form) in order to harvest a valid nonce for the 'stm_mark_as_sold_car' action, which can then be replayed against any other listing's post ID.

Subscriber Cross Site Scripting (XSS) in MasterStudy LMS <= 3.7.27 versions.

Subscriber Broken Access Control in MasterStudy LMS <= 3.7.30 versions.

Contributor Local File Inclusion in Splash - Sport Club WordPress Theme for Basketball, Football, Hockey <= 4.4.3 versions.

Unauthenticated Broken Access Control in Motors <= 1.4.109 versions.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Blind SQL Injection.This issue affects Motors: from n/a through 1.4.109.

CVE-2026-54814 is a high severity vulnerability in StylemixThemes Motors affecting versions up to and including 1.4.109. It involves improper control of filenames used in PHP include or require statements, leading to a PHP Local File Inclusion issue. This vulnerability can allow an attacker to include unintended files, potentially resulting in full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-40766 is a high-severity SQL Injection vulnerability affecting StylemixThemes MasterStudy LMS versions up to and including 3.7.25. The issue involves improper neutralization of special elements in SQL commands related to subscriber data, potentially allowing an attacker with low privileges to execute unauthorized SQL queries. This vulnerability can lead to high confidentiality impact and limited availability impact. No official patch or remediation guidance is currently confirmed.

A missing authorization vulnerability (CWE-862) exists in StylemixThemes Motors versions prior to 1.4.107. This vulnerability involves broken access control affecting subscriber functionality. It has a medium severity with a CVSS score of 6.5 and can cause availability impact. No official patch or remediation guidance is currently provided by the vendor.

CVE-2025-64215 is a missing authorization vulnerability in StylemixThemes MasterStudy LMS Pro that allows unauthorized access to functionality due to improper access control. The issue affects versions before 4.7.16. The vulnerability has a CVSS score of 6.5, indicating a medium severity level. There is no confirmed patch or official remediation available at this time. No known exploits are reported in the wild.

The MasterStudy LMS Pro Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'columns' parameter in all versions up to, and including, 4.8.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with instructor-level access or above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Blind SQL Injection.This issue affects MasterStudy LMS: from n/a through <= 3.7.29.

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 1.4.107. This is due to insufficient file path validation in the become-dealer logo upload flow. The plugin allows any authenticated user to set an arbitrary filesystem path via the profile update handler. This makes it possible for authenticated attackers, with subscriber level access and above, to delete arbitrary files on the server.

The Cost Calculator Builder plugin for WordPress is vulnerable to Unauthenticated Price Manipulation and Insecure Direct Object Reference (IDOR) in all versions up to, and including, 4.0.1 only when used in combination with Cost Calculator Builder PRO. This is due to the ccb_woocommerce_payment AJAX action being registered via wp_ajax_nopriv, making it accessible to unauthenticated users, and the renderWooCommercePayment() function passing user-controlled data directly to CCBWooCheckout::init() without authorization checks. This makes it possible for unauthenticated attackers to add WooCommerce products to their cart with attacker-controlled prices.