Skip to content
Noroxi

StylemixThemes records

66 published records for vendor StylemixThemes. 0 of them have been exploited in the wild (listed in CISA KEV) and 1 have a ready-made attack tool.

Filter by product ↓

Researcher profile

Entered KEV
0 · 0%
Weaponized
1 · 1.5%
Pre-auth RCE
2
With a fix record
37.9%
Median publish → KEV
No record has entered KEV

Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.

Records by year

  1. 20
  2. 21
  3. 22
  4. 23
  5. 24
  6. 25
  7. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

66 records
  • CVE-2022-0441
    65This week

    MasterStudy LMS < 2.7.6 - Unauthenticated Admin Account Creation

    CriticalCVSS 9.8WeaponizedEPSS 85%

    stylemixthemes · masterstudy lmsMar 7, 2022

  • CVE-2024-1512
    62This week

    MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.2.5 - Unauthenticated SQL Injection

    CriticalCVSS 9.8Proof of conceptEPSS 77%

    stylemixthemes · masterstudy lmsFeb 17, 2024

  • CVE-2024-3136
    41Plan

    MasterStudy LMS <= 3.3.3 - Unauthenticated Local File Inclusion via template

    CriticalCVSS 9.8Proof of conceptEPSS 5%

    stylemixthemes · masterstudy lmsApr 9, 2024

  • CVE-2021-36879
    40Plan

    WordPress uListing plugin <= 2.0.5 - Unauthenticated Privilege Escalation vulnerability

    CriticalCVSS 9.8No exploitEPSS 2%

    stylemixthemes · ulistingSep 27, 2021

  • CVE-2021-36880
    40Plan

    WordPress uListing plugin <= 2.0.3 - Unauthenticated SQL Injection (SQLi) vulnerability

    CriticalCVSS 9.8No exploitEPSS 2%

    stylemixthemes · ulistingSep 27, 2021

  • CVE-2024-43144
    40Plan

    WordPress Cost Calculator Builder plugin <= 3.2.15 - SQL Injection vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    stylemixthemes · cost calculator builderAug 29, 2024

  • CVE-2023-2834
    40Plan

    BookIt <= 2.3.7 - Authentication Bypass

    CriticalCVSS 9.8No exploitEPSS 1%

    stylemixthemes · bookitJun 29, 2023

  • CVE-2024-2411
    39Monitor

    MasterStudy LMS <= 3.3.0 - Unauthenticated Local File Inclusion via modal

    CriticalCVSS 9.8No exploitEPSS 1%

    stylemixthemes · masterstudy lmsMar 29, 2024

  • CVE-2021-4343
    39Monitor

    uListing <= 1.6.6 - Unauthenticated Arbitrary Account Creation

    CriticalCVSS 9.8No exploitEPSS 1%

    stylemixthemes · ulistingJun 6, 2023

  • CVE-2021-4381
    39Monitor

    uListing <= 1.6.6 - Unauthenticated Options Changes via wp_route

    CriticalCVSS 9.8No exploitEPSS 1%

    stylemixthemes · ulistingJun 6, 2023

  • CVE-2021-4370
    39Monitor

    uListing <= 1.6.6 - Missing Authorization

    CriticalCVSS 9.8No exploitEPSS 1%

    stylemixthemes · ulistingJun 6, 2023

  • CVE-2021-4341
    39Monitor

    uListing <= 1.6.6 - Unauthenticated Wordpress Options Changes via AJAX

    CriticalCVSS 9.8No exploitEPSS 1%

    stylemixthemes · ulistingJun 6, 2023

  • CVE-2024-2409
    39Monitor

    MasterStudy LMS <= 3.3.1 - Unauthenticated Privilege Escalation via stm_lms_register AJAX Action

    CriticalCVSS 9.8No exploitEPSS 0%

    stylemixthemes · masterstudy lmsMar 29, 2024

  • CVE-2024-37089
    39Monitor

    WordPress Consulting Elementor Widgets plugin <= 1.3.0 - Unauthenticated Local File Inclusion vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    stylemixthemes · consulting elementor widgetsJun 24, 2024

  • CVE-2024-35677
    39Monitor

    WordPress MegaMenu plugin <= 2.3.12 - Unauthenticated Local File Inclusion vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    stylemixthemes · mega menuJun 10, 2024

  • CVE-2024-37094
    39Monitor

    WordPress MasterStudy LMS plugin <= 3.2.12 - Broken Access Control vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    stylemixthemes · masterstudy lmsNov 1, 2024

  • CVE-2024-37091
    35Monitor

    WordPress Consulting Elementor Widgets plugin <= 1.3.0 - Remote Code Execution (RCE) vulnerability

    HighCVSS 8.8No exploitEPSS 1%

    stylemixthemes · consulting elementor widgetsJun 24, 2024

  • CVE-2022-3989
    35Monitor

    Motors - Car Dealer, Classifieds & Listing < 1.4.4 - Arbitrary File Upload

    HighCVSS 8.8No exploitEPSS 1%

    stylemixthemes · motors - car dealer\, classifieds \& listingDec 12, 2022

  • CVE-2021-36874
    35Monitor

    WordPress uListing plugin <= 2.0.5 - Authenticated Insecure Direct Object References (IDOR) vulnerability

    HighCVSS 8.8No exploitEPSS 1%

    stylemixthemes · ulistingSep 27, 2021

  • CVE-2025-2807
    35Monitor

    Motors – Car Dealership & Classified Listings Plugin <= 1.4.64 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation

    HighCVSS 8.8Proof of conceptEPSS 0%

    stylemixthemes · motors - car dealer\, classifieds \& listingApr 8, 2025

  • CVE-2024-37090
    35Monitor

    SQL Injection vulnerability in multiple StylemixThemes premium themes

    HighCVSS 8.8No exploitEPSS 0%

    stylemixthemes · consulting elementor widgetsJul 9, 2024

  • CVE-2025-1653
    35Monitor

    Directory Listings WordPress plugin – uListing <= 2.2.0 - Authenticated (Subscriber+) Privilege Escalation

    HighCVSS 8.8No exploitEPSS 0%

    stylemixthemes · ulistingMar 14, 2025

  • CVE-2024-37092
    35Monitor

    WordPress Consulting Elementor Widgets plugin <= 1.3.0 - Local File Inclusion vulnerability

    HighCVSS 8.8No exploitEPSS 0%

    stylemixthemes · consulting elementor widgetsJun 24, 2024

  • CVE-2024-5973
    35Monitor

    MasterStudy LMS < 3.3.24 - Privilege Escalation to Instructor

    HighCVSS 8.8No exploitEPSS 0%

    stylemixthemes · masterstudy lmsJul 22, 2024

  • CVE-2021-36876
    35Monitor

    WordPress uListing plugin <= 2.0.5 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities

    HighCVSS 8.8No exploitEPSS 0%

    stylemixthemes · ulistingSep 27, 2021