stylemix vulnerabilities

CVEs per yearBy the year they were published

1. 20211
2. 20239
3. 202413
4. 202534
5. 202635

Newest CVEs

• CVE-2026-104746

  Motors <= 1.4.125 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_user_avatar_path' User Meta

  stylemix · Motors – Car Dealership & Classified Listings Plugin

  High8.1
• CVE-2026-116562

  Motors <= 1.4.128 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Taxonomy Term Name via 'stm_f_s' Parameter

  stylemix · Motors – Car Dealership & Classified Listings Plugin

  Medium6.4
• CVE-2026-116617

  Motors <= 1.4.128 - Authenticated (Subscriber+) File Deletion via 'stm_dealer_logo_path' Parameter

  stylemix · Motors – Car Dealership & Classified Listings Plugin

  High8.1
• CVE-2026-118090

  WordPress MasterStudy LMS plugin <= 3.7.55 - PHP Object Injection vulnerability

  Stylemix · MasterStudy LMS

  High8.8
• CVE-2026-80069

  MasterStudy LMS WordPress Plugin < 3.7.50 Missing Authorization via stm_lms_send_test_email_ajax

  Stylemix · MasterStudy LMS WordPress Plugin

  Medium5.3
• CVE-2026-80067

  MasterStudy LMS WordPress Plugin < 3.7.50 Path Traversal via stm_lms_step Parameter

  Stylemix · MasterStudy LMS WordPress Plugin

  Medium5.3
• CVE-2026-62033

  WordPress uListing plugin <= 2.2.0 - Settings Change vulnerability

  Stylemix · uListing

  High7.6
• CVE-2026-62031

  WordPress uListing plugin <= 2.2.0 - SQL Injection vulnerability

  Stylemix · uListing

  Critical9.3
• CVE-2026-96563

  Motors <= 1.4.124 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'stm_f_s' Parameter

  stylemix · Motors – Car Dealership & Classified Listings Plugin

  Medium6.4
• CVE-2026-6806

  Motors <= 1.4.109 - Unauthenticated Blind SQL Injection via 'stm_lat'/'stm_lng' Parameters

  stylemix · Motors – Car Dealership & Classified Listings Plugin

  High7.5