Stylemix
Monthly
Unauthenticated arbitrary file deletion in the MasterStudy LMS WordPress plugin (versions ≤ 3.7.42) allows remote, unauthenticated attackers to delete arbitrary files on the server via path traversal. The CVSS 8.6 vector (AV:N/AC:L/PR:N/UI:N/S:C/A:H) confirms no authentication or user interaction is required and that impact extends beyond the plugin's own scope to server-level files. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-prerequisite attack surface makes this a high-priority patch target for all WordPress deployments running the affected plugin.
Stored cross-site scripting in the StyleMix Motors - Car Dealership & Classified Listings plugin for WordPress (all versions through 1.4.112) lets unauthenticated attackers persist malicious JavaScript through the Comment Content and User Biographical Info fields, which then executes in the browser of any visitor or administrator who views the affected page. The scope-changed CVSS 3.1 score of 7.2 reflects that injected script runs in a security context different from the vulnerable component. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated injection path makes it broadly abusable against sites running this popular automotive/classifieds plugin.
Arbitrary file deletion in the Motors - Car Dealership & Classified Listings Plugin for WordPress (versions up to and including 1.4.107) allows authenticated users with subscriber-level access or higher to delete arbitrary files on the server by supplying a malicious filesystem path through the become-dealer logo upload flow. The flaw was reported by Wordfence and carries a CVSS of 8.1, but EPSS remains very low (0.05%) and CISA SSVC reports no observed exploitation, indicating risk is theoretical rather than active. No public exploit identified at time of analysis.
Remote code execution via subscriber-level authorization bypass in the Checkout Custom Fields Builder for WooCommerce WordPress plugin (all versions ≤1.1.5) allows any authenticated subscriber to install an arbitrary attacker-hosted PHP plugin and achieve full server compromise. The plugin registers AJAX endpoints for plugin installation and activation without enforcing WordPress capability checks, and the required nonce is emitted directly into all admin pages visible to subscribers when WooCommerce is inactive - making the exploit trivially accessible to any registered user. No public exploit code has been identified, but the low authentication barrier and clear exploit path represent a critical risk on multi-user WordPress sites.
Broken Access Control in the MasterStudy LMS WordPress plugin (versions up to and including 3.7.41) permits any authenticated subscriber to bypass role-based authorization checks and access data restricted to higher-privilege roles, resulting in high confidentiality impact. The CVSS vector confirms this is network-exploitable with low complexity and no user interaction required beyond holding a subscriber-level account. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low barrier to exploitation on open-registration LMS platforms makes this a credible threat to sensitive course and student data.
Privilege escalation in the MasterStudy LMS WordPress plugin (versions up to and including 3.7.41) enables authenticated subscriber-level users to exceed their intended permissions through incorrect privilege assignment (CWE-266). Discovered and disclosed by Patchstack and tracked as ENISA EUVD-2026-60936, the flaw affects deployments by Stylemix on the WordPress platform worldwide. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Broken Access Control in the Motors WordPress plugin (car dealership and classified listings, by Stylemix) through version 1.4.113 allows subscriber-level authenticated users to perform privileged actions that should be restricted to higher roles, resulting in a high integrity impact. The flaw is classified as CWE-862 (Missing Authorization), meaning the plugin fails to verify whether the requesting user has sufficient privileges before executing sensitive operations. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Cost Calculator Builder for WordPress exposes live payment gateway credentials to any authenticated site user through a missing authorization check on its calculator export AJAX endpoint. All plugin versions through 3.6.17 are affected; attackers holding a Subscriber-level WordPress account - the lowest authenticated role - can invoke the `cost-calculator-custom-export-run` AJAX action to receive a full configuration export containing Stripe secret keys, PayPal client secrets, Razorpay secret keys, webhook secret keys, and reCAPTCHA secret keys. No public proof-of-concept exploit or CISA KEV listing has been identified at time of analysis, but the attack requires only a valid site account and basic HTTP knowledge, and an upstream fix has been committed to the plugin's trunk repository.
Insecure Direct Object Reference in MasterStudy LMS WordPress Plugin (all versions through 3.7.14) allows authenticated Instructors to permanently delete media attachments belonging to any other WordPress user. The `stm_lms_delete_cover()` function accepts a caller-supplied `file_id` and passes it directly to WordPress's `wp_delete_attachment()` without verifying that the requesting user owns the referenced attachment. Because WordPress stores attachments with sequential integer IDs, an Instructor-level account holder can iterate over IDs to destroy course materials, profile images, or uploaded documents created by students, other instructors, or administrators. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Broken access control in the uListing WordPress plugin (versions <= 2.2.0) allows authenticated users holding the Contributor role to perform privileged actions beyond their authorization level, resulting in unauthorized data modification. The flaw stems from missing authorization checks (CWE-862), confirmed by Patchstack, with a CVSS 3.1 score of 4.3. No active exploitation has been identified, but the low attack complexity and network accessibility make this a realistic lateral-privilege risk on affected WordPress installations running the plugin.
Broken access control in the uListing WordPress plugin (versions <= 2.2.0) by Stylemix permits subscriber-level authenticated users to invoke plugin functionality reserved for higher-privileged roles. The root cause (CWE-862, Missing Authorization) means the plugin does not enforce role checks before executing sensitive operations, allowing low-privilege accounts to impact integrity and availability of listing data. No public exploit code or active exploitation has been identified at the time of analysis.
Plaintext payment gateway secret key exposure in the Cost Calculator Builder WordPress plugin (all versions ≤ 4.0.11) allows any unauthenticated remote visitor to harvest Stripe, Razorpay, and PayPal merchant credentials directly from page HTML source. The plugin embeds live API secret keys in the frontend template body when the 'use in all calculators' global payment gateway option is active, making those keys readable without any authentication or special tooling. While the assigned CVSS score is 5.3 (Medium), the practical impact is business-critical: extracted secret keys grant full programmatic control over the merchant's payment accounts, enabling unauthorized charges, refunds, and access to stored customer payment data. No public exploit or CISA KEV listing is identified at time of analysis.
Authorization bypass in the Motors - Car Dealership & Classified Listings Plugin for WordPress allows authenticated subscriber-level users to arbitrarily mark any other user's vehicle listing as sold by replaying a harvested nonce against a victim's post ID. All plugin versions up to and including 1.4.111 are affected. An attacker exploiting this flaw can silently deface competitor or victim listings with a site-wide 'Sold' badge while also stripping the `special_car` featured post meta, causing business harm on dealership or classifieds sites. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.
Stored Cross-Site Scripting in the MasterStudy LMS WordPress plugin (versions <= 3.7.27) allows authenticated subscriber-level users to inject malicious scripts that execute in the browsers of higher-privileged users such as administrators. The vulnerability carries a Scope:Changed CVSS vector, meaning successful exploitation breaks the browser security boundary and can impact resources beyond the plugin itself - enabling session hijacking, credential theft, or privilege escalation within the WordPress admin context. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low privilege bar (subscriber role) widens the attacker pool considerably on sites with open or paid user registration.
Unauthenticated attackers can manipulate product prices in WooCommerce carts via an unprotected AJAX action in the Cost Calculator Builder plugin for WordPress (versions up to 4.0.1) when used with Cost Calculator Builder PRO. The vulnerability stems from the ccb_woocommerce_payment AJAX endpoint being registered without authentication requirements (wp_ajax_nopriv) and failing to validate user input before passing it to checkout initialization, allowing price modification without authorization. This is an Insecure Direct Object Reference (IDOR) flaw with moderate CVSS score (5.3) that enables integrity violations but not confidentiality breaches or availability impact.
Authenticated users with Subscriber-level access can bypass PayPal payment verification in the Motors - Car Dealership & Classified Listings WordPress plugin (versions up to 1.4.103) by directly modifying their stm_payment_status user meta field to 'completed', gaining access to paid Dealer membership features without completing any transaction. The vulnerability exists in the stm_save_user_extra_fields() function, which fails to validate permission for sensitive meta field modifications during profile updates. While CVSS 4.3 reflects low severity, the integrity impact is direct-payment systems are completely circumvented for any authenticated user.
Time-based blind SQL injection in MasterStudy LMS WordPress plugin up to version 3.7.25 allows authenticated subscribers and above to extract sensitive database information including user credentials and session tokens via unquoted ORDER BY clause injection in the /lms/stm-lms/order/items REST API endpoint. The vulnerability stems from a custom Query builder that concatenates user-supplied sort parameters containing parentheses directly into SQL ORDER BY clauses without proper quoting, bypassing the plugin's use of esc_sql(). CVSS score of 6.5 reflects network-accessible exploitation requiring low privilege (subscriber-level) authentication and no user interaction.
Unauthenticated arbitrary file deletion in the MasterStudy LMS WordPress plugin (versions ≤ 3.7.42) allows remote, unauthenticated attackers to delete arbitrary files on the server via path traversal. The CVSS 8.6 vector (AV:N/AC:L/PR:N/UI:N/S:C/A:H) confirms no authentication or user interaction is required and that impact extends beyond the plugin's own scope to server-level files. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-prerequisite attack surface makes this a high-priority patch target for all WordPress deployments running the affected plugin.
Stored cross-site scripting in the StyleMix Motors - Car Dealership & Classified Listings plugin for WordPress (all versions through 1.4.112) lets unauthenticated attackers persist malicious JavaScript through the Comment Content and User Biographical Info fields, which then executes in the browser of any visitor or administrator who views the affected page. The scope-changed CVSS 3.1 score of 7.2 reflects that injected script runs in a security context different from the vulnerable component. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated injection path makes it broadly abusable against sites running this popular automotive/classifieds plugin.
Arbitrary file deletion in the Motors - Car Dealership & Classified Listings Plugin for WordPress (versions up to and including 1.4.107) allows authenticated users with subscriber-level access or higher to delete arbitrary files on the server by supplying a malicious filesystem path through the become-dealer logo upload flow. The flaw was reported by Wordfence and carries a CVSS of 8.1, but EPSS remains very low (0.05%) and CISA SSVC reports no observed exploitation, indicating risk is theoretical rather than active. No public exploit identified at time of analysis.
Remote code execution via subscriber-level authorization bypass in the Checkout Custom Fields Builder for WooCommerce WordPress plugin (all versions ≤1.1.5) allows any authenticated subscriber to install an arbitrary attacker-hosted PHP plugin and achieve full server compromise. The plugin registers AJAX endpoints for plugin installation and activation without enforcing WordPress capability checks, and the required nonce is emitted directly into all admin pages visible to subscribers when WooCommerce is inactive - making the exploit trivially accessible to any registered user. No public exploit code has been identified, but the low authentication barrier and clear exploit path represent a critical risk on multi-user WordPress sites.
Broken Access Control in the MasterStudy LMS WordPress plugin (versions up to and including 3.7.41) permits any authenticated subscriber to bypass role-based authorization checks and access data restricted to higher-privilege roles, resulting in high confidentiality impact. The CVSS vector confirms this is network-exploitable with low complexity and no user interaction required beyond holding a subscriber-level account. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low barrier to exploitation on open-registration LMS platforms makes this a credible threat to sensitive course and student data.
Privilege escalation in the MasterStudy LMS WordPress plugin (versions up to and including 3.7.41) enables authenticated subscriber-level users to exceed their intended permissions through incorrect privilege assignment (CWE-266). Discovered and disclosed by Patchstack and tracked as ENISA EUVD-2026-60936, the flaw affects deployments by Stylemix on the WordPress platform worldwide. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Broken Access Control in the Motors WordPress plugin (car dealership and classified listings, by Stylemix) through version 1.4.113 allows subscriber-level authenticated users to perform privileged actions that should be restricted to higher roles, resulting in a high integrity impact. The flaw is classified as CWE-862 (Missing Authorization), meaning the plugin fails to verify whether the requesting user has sufficient privileges before executing sensitive operations. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Cost Calculator Builder for WordPress exposes live payment gateway credentials to any authenticated site user through a missing authorization check on its calculator export AJAX endpoint. All plugin versions through 3.6.17 are affected; attackers holding a Subscriber-level WordPress account - the lowest authenticated role - can invoke the `cost-calculator-custom-export-run` AJAX action to receive a full configuration export containing Stripe secret keys, PayPal client secrets, Razorpay secret keys, webhook secret keys, and reCAPTCHA secret keys. No public proof-of-concept exploit or CISA KEV listing has been identified at time of analysis, but the attack requires only a valid site account and basic HTTP knowledge, and an upstream fix has been committed to the plugin's trunk repository.
Insecure Direct Object Reference in MasterStudy LMS WordPress Plugin (all versions through 3.7.14) allows authenticated Instructors to permanently delete media attachments belonging to any other WordPress user. The `stm_lms_delete_cover()` function accepts a caller-supplied `file_id` and passes it directly to WordPress's `wp_delete_attachment()` without verifying that the requesting user owns the referenced attachment. Because WordPress stores attachments with sequential integer IDs, an Instructor-level account holder can iterate over IDs to destroy course materials, profile images, or uploaded documents created by students, other instructors, or administrators. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Broken access control in the uListing WordPress plugin (versions <= 2.2.0) allows authenticated users holding the Contributor role to perform privileged actions beyond their authorization level, resulting in unauthorized data modification. The flaw stems from missing authorization checks (CWE-862), confirmed by Patchstack, with a CVSS 3.1 score of 4.3. No active exploitation has been identified, but the low attack complexity and network accessibility make this a realistic lateral-privilege risk on affected WordPress installations running the plugin.
Broken access control in the uListing WordPress plugin (versions <= 2.2.0) by Stylemix permits subscriber-level authenticated users to invoke plugin functionality reserved for higher-privileged roles. The root cause (CWE-862, Missing Authorization) means the plugin does not enforce role checks before executing sensitive operations, allowing low-privilege accounts to impact integrity and availability of listing data. No public exploit code or active exploitation has been identified at the time of analysis.
Plaintext payment gateway secret key exposure in the Cost Calculator Builder WordPress plugin (all versions ≤ 4.0.11) allows any unauthenticated remote visitor to harvest Stripe, Razorpay, and PayPal merchant credentials directly from page HTML source. The plugin embeds live API secret keys in the frontend template body when the 'use in all calculators' global payment gateway option is active, making those keys readable without any authentication or special tooling. While the assigned CVSS score is 5.3 (Medium), the practical impact is business-critical: extracted secret keys grant full programmatic control over the merchant's payment accounts, enabling unauthorized charges, refunds, and access to stored customer payment data. No public exploit or CISA KEV listing is identified at time of analysis.
Authorization bypass in the Motors - Car Dealership & Classified Listings Plugin for WordPress allows authenticated subscriber-level users to arbitrarily mark any other user's vehicle listing as sold by replaying a harvested nonce against a victim's post ID. All plugin versions up to and including 1.4.111 are affected. An attacker exploiting this flaw can silently deface competitor or victim listings with a site-wide 'Sold' badge while also stripping the `special_car` featured post meta, causing business harm on dealership or classifieds sites. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.
Stored Cross-Site Scripting in the MasterStudy LMS WordPress plugin (versions <= 3.7.27) allows authenticated subscriber-level users to inject malicious scripts that execute in the browsers of higher-privileged users such as administrators. The vulnerability carries a Scope:Changed CVSS vector, meaning successful exploitation breaks the browser security boundary and can impact resources beyond the plugin itself - enabling session hijacking, credential theft, or privilege escalation within the WordPress admin context. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low privilege bar (subscriber role) widens the attacker pool considerably on sites with open or paid user registration.
Unauthenticated attackers can manipulate product prices in WooCommerce carts via an unprotected AJAX action in the Cost Calculator Builder plugin for WordPress (versions up to 4.0.1) when used with Cost Calculator Builder PRO. The vulnerability stems from the ccb_woocommerce_payment AJAX endpoint being registered without authentication requirements (wp_ajax_nopriv) and failing to validate user input before passing it to checkout initialization, allowing price modification without authorization. This is an Insecure Direct Object Reference (IDOR) flaw with moderate CVSS score (5.3) that enables integrity violations but not confidentiality breaches or availability impact.
Authenticated users with Subscriber-level access can bypass PayPal payment verification in the Motors - Car Dealership & Classified Listings WordPress plugin (versions up to 1.4.103) by directly modifying their stm_payment_status user meta field to 'completed', gaining access to paid Dealer membership features without completing any transaction. The vulnerability exists in the stm_save_user_extra_fields() function, which fails to validate permission for sensitive meta field modifications during profile updates. While CVSS 4.3 reflects low severity, the integrity impact is direct-payment systems are completely circumvented for any authenticated user.
Time-based blind SQL injection in MasterStudy LMS WordPress plugin up to version 3.7.25 allows authenticated subscribers and above to extract sensitive database information including user credentials and session tokens via unquoted ORDER BY clause injection in the /lms/stm-lms/order/items REST API endpoint. The vulnerability stems from a custom Query builder that concatenates user-supplied sort parameters containing parentheses directly into SQL ORDER BY clauses without proper quoting, bypassing the plugin's use of esc_sql(). CVSS score of 6.5 reflects network-accessible exploitation requiring low privilege (subscriber-level) authentication and no user interaction.