CVE-2026-62033 is a high-severity vulnerability in Stylemix uListing versions up to 2.2.0 that involves missing authorization controls. This flaw allows unauthorized changes to subscriber settings, potentially impacting confidentiality, integrity, and availability of the affected system.
CVE-2026-62031 is a critical SQL Injection vulnerability affecting Stylemix uListing versions up to and including 2.2.0. It allows unauthenticated attackers to inject malicious SQL commands due to improper neutralization of special elements in SQL queries. This vulnerability can lead to high confidentiality impact and low availability impact, with no integrity impact reported.
The Motors – Car Dealership & Classified Listings Plugin for WordPress versions up to 1.4.124 is vulnerable to stored cross-site scripting (XSS) via the 'stm_f_s' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping. The AJAX handler nonce required for exploitation is exposed on every page, facilitating exploitation without higher privileges.
CVE-2026-93950 is a Missing Authorization vulnerability in the StylemixThemes Motors product, affecting versions from 0 up to and including 1.4.108. The flaw allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized actions. The vulnerability has a high severity with a CVSS score of 7.5. No official patch or remediation information is provided in the available data.
CVE-2026-105079 is a stored cross-site scripting (XSS) vulnerability in StylemixThemes MasterStudy LMS up to version 3.7.52. It allows improper neutralization of input during web page generation, potentially enabling attackers with limited privileges to inject malicious scripts. The vulnerability has a medium severity with a CVSS score of 6.5.
Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Motors allows Retrieve Embedded Sensitive Data.
This issue affects Motors: from n/a through 1.4.124.
CVE-2026-97307 is a vulnerability in StylemixThemes Cost Calculator Builder up to version 4.0.17 that allows insertion of sensitive information into sent data, enabling retrieval of embedded sensitive data. This issue affects all versions from initial release through 4.0.17. The vulnerability has a high severity with a CVSS score of 7.5 and does not require user interaction or privileges to exploit.
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'stm_lat/stm_lng' parameter in all versions up to, and including, 1.4.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
The Motors – Car Dealership & Classified Listings Plugin for WordPress contains a missing authorization vulnerability in the mvl_ajax_dealer_load_cars() function. This flaw affects all versions up to and including 1.4.120 and allows unauthenticated attackers to access draft, pending, private, and future car listings of arbitrary users. The vulnerability has a medium severity rating with a CVSS score of 5.3.
The Consulting theme for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 6.7.16. This is due to a combination of two flaws: (1) the masterstudy_ms_stm_set_discard_transient AJAX endpoint in admin/admin-notices/classes/STMHandler.php accepts an arbitrary transient key without capability checks or nonce validation, and (2) the developer access login mechanism in admin/classes/stm-theme-support.php authenticates users based on a transient value without proper cryptographic validation when in legacy string mode. This makes it possible for authenticated attackers, with subscriber-level access and above, to set the stm_developer_access_token transient to a known value (1), then authenticate as any existing user including administrators by visiting a specially crafted URL, thereby achieving full privilege escalation to administrator.
The Checkout Custom Fields Builder for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to install and activate an arbitrary attacker-hosted plugin, resulting in remote code execution on the server. The required nonce is emitted inline on all admin pages accessible to subscribers when WooCommerce is inactive, meaning any subscriber-level user can harvest it and trigger the exploit without any additional privileges.
CVE-2026-78284 is a high-severity vulnerability in Stylemix MasterStudy LMS versions up to and including 3.7.42. It involves an unauthenticated arbitrary file deletion due to improper limitation of a pathname to a restricted directory (path traversal). This flaw allows attackers without any privileges to delete files on the affected system, potentially causing denial of service or disruption of LMS functionality.
The Cost Calculator Builder plugin for WordPress has a missing authorization vulnerability in its AJAX export action, allowing authenticated users with Subscriber-level access or higher to export sensitive configuration data. This includes secret keys for Stripe, PayPal, Razorpay, webhook, and reCAPTCHA. The vulnerability affects all versions up to and including 3.6.17. The plugin only verifies a nonce that is publicly available to all authenticated users, failing to check user capabilities properly.
CVE-2026-28145 is a medium severity vulnerability in StylemixThemes MasterStudy LMS affecting versions up to and including 3.7.39. It involves insufficient verification of data authenticity, which allows manipulation of user state. The vulnerability does not impact confidentiality or availability but affects integrity. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
The MasterStudy LMS WordPress Plugin for Online Courses and Education is affected by an insecure direct object reference vulnerability in all versions up to and including 3.7.14. This vulnerability allows authenticated users with Instructor-level access or higher to delete arbitrary attachments belonging to any user by exploiting a lack of ownership validation in the deletion function. The issue arises from the stm_lms_delete_cover() function not verifying the ownership of the file_id parameter before calling wp_delete_attachment().
The Cost Calculator Builder PRO WordPress plugin up to version 4.0.3 contains a critical remote code execution vulnerability due to improper sanitization in the js_to_php function. An unauthenticated attacker can exploit this by injecting malicious code into the orderDetails[*].originalValue field, which is passed unsafely to PHP eval(). The nonce intended as an authentication barrier is publicly exposed on all front-end pages, allowing attackers to bypass it. The vulnerability has a CVSS score of 9.8, indicating critical severity.