Threat database

CVE-2026-93950 is a Missing Authorization vulnerability in the StylemixThemes Motors product, affecting versions from 0 up to and including 1.4.108. The flaw allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized actions. The vulnerability has a high severity with a CVSS score of 7.5. No official patch or remediation information is provided in the available data.

CVE-2026-105079 is a stored cross-site scripting (XSS) vulnerability in StylemixThemes MasterStudy LMS up to version 3.7.52. It allows improper neutralization of input during web page generation, potentially enabling attackers with limited privileges to inject malicious scripts. The vulnerability has a medium severity with a CVSS score of 6.5.

Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Motors allows Retrieve Embedded Sensitive Data. This issue affects Motors: from n/a through 1.4.124.

CVE-2026-97307 is a vulnerability in StylemixThemes Cost Calculator Builder up to version 4.0.17 that allows insertion of sensitive information into sent data, enabling retrieval of embedded sensitive data. This issue affects all versions from initial release through 4.0.17. The vulnerability has a high severity with a CVSS score of 7.5 and does not require user interaction or privileges to exploit.

The Consulting theme for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 6.7.16. This is due to a combination of two flaws: (1) the masterstudy_ms_stm_set_discard_transient AJAX endpoint in admin/admin-notices/classes/STMHandler.php accepts an arbitrary transient key without capability checks or nonce validation, and (2) the developer access login mechanism in admin/classes/stm-theme-support.php authenticates users based on a transient value without proper cryptographic validation when in legacy string mode. This makes it possible for authenticated attackers, with subscriber-level access and above, to set the stm_developer_access_token transient to a known value (1), then authenticate as any existing user including administrators by visiting a specially crafted URL, thereby achieving full privilege escalation to administrator.

CVE-2026-28145 is a medium severity vulnerability in StylemixThemes MasterStudy LMS affecting versions up to and including 3.7.39. It involves insufficient verification of data authenticity, which allows manipulation of user state. The vulnerability does not impact confidentiality or availability but affects integrity. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

The Cost Calculator Builder PRO WordPress plugin up to version 4.0.3 contains a critical remote code execution vulnerability due to improper sanitization in the js_to_php function. An unauthenticated attacker can exploit this by injecting malicious code into the orderDetails[*].originalValue field, which is passed unsafely to PHP eval(). The nonce intended as an authentication barrier is publicly exposed on all front-end pages, allowing attackers to bypass it. The vulnerability has a CVSS score of 9.8, indicating critical severity.

Missing Authorization vulnerability in StylemixThemes Motors motors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a before 5.6.85.

Unauthenticated Local File Inclusion in Pearl - Corporate Business <= 3.4.10 versions.

Contributor Local File Inclusion in Splash - Sport Club WordPress Theme for Basketball, Football, Hockey <= 4.4.3 versions.

Unauthenticated Broken Access Control in Motors <= 1.4.109 versions.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Blind SQL Injection.This issue affects Motors: from n/a through 1.4.109.

CVE-2026-54814 is a high severity vulnerability in StylemixThemes Motors affecting versions up to and including 1.4.109. It involves improper control of filenames used in PHP include or require statements, leading to a PHP Local File Inclusion issue. This vulnerability can allow an attacker to include unintended files, potentially resulting in full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-40766 is a high-severity SQL Injection vulnerability affecting StylemixThemes MasterStudy LMS versions up to and including 3.7.25. The issue involves improper neutralization of special elements in SQL commands related to subscriber data, potentially allowing an attacker with low privileges to execute unauthorized SQL queries. This vulnerability can lead to high confidentiality impact and limited availability impact. No official patch or remediation guidance is currently confirmed.

A missing authorization vulnerability (CWE-862) exists in StylemixThemes Motors versions prior to 1.4.107. This vulnerability involves broken access control affecting subscriber functionality. It has a medium severity with a CVSS score of 6.5 and can cause availability impact. No official patch or remediation guidance is currently provided by the vendor.

CVE-2025-64215 is a missing authorization vulnerability in StylemixThemes MasterStudy LMS Pro that allows unauthorized access to functionality due to improper access control. The issue affects versions before 4.7.16. The vulnerability has a CVSS score of 6.5, indicating a medium severity level. There is no confirmed patch or official remediation available at this time. No known exploits are reported in the wild.

The MasterStudy LMS Pro Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'columns' parameter in all versions up to, and including, 4.8.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with instructor-level access or above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Unrestricted Upload of File with Dangerous Type vulnerability in StylemixThemes Motors motors allows Using Malicious Files.This issue affects Motors: from n/a through <= 5.6.81.

Missing Authorization vulnerability in StylemixThemes MasterStudy LMS Pro masterstudy-lms-learning-management-system-pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects MasterStudy LMS Pro: from n/a through < 4.7.16.