Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

Stylemix — Vulnerabilities & Security Advisories 80

Browse all 80 CVE security advisories affecting Stylemix. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Stylemix operates as a digital asset management and theme development platform, primarily serving web designers and content creators who require robust tools for managing media libraries and deploying WordPress themes. Security audits reveal a concerning history of vulnerabilities, with sixty-three Common Vulnerabilities and Exposures (CVEs) currently documented. These flaws predominantly involve cross-site scripting (XSS) and remote code execution (RCE), often stemming from insufficient input validation and improper access controls. Privilege escalation remains a significant risk, allowing unauthorized users to manipulate system functions or access restricted data. While specific major incidents involving widespread exploitation are not widely publicized, the high volume of disclosed CVEs indicates persistent weaknesses in the software’s security architecture. Developers and administrators are advised to prioritize immediate patching and rigorous security testing to mitigate these known risks and protect associated web infrastructure from potential compromise.

CVE ID Title CVSS Severity Published
CVE-2025-59577 WordPress MasterStudy LMS Plugin <= 3.6.20 - Race Condition Vulnerability — MasterStudy LMS CWE-362 4.3 Medium 2025-09-22
CVE-2025-54744 WordPress MasterStudy LMS plugin <= 3.6.15 - Broken Access Control vulnerability — MasterStudy LMS CWE-862 6.5 Medium 2025-09-05
CVE-2025-54691 WordPress Motors Plugin plugin <= 1.4.80 - Insecure Direct Object References (IDOR) Vulnerability — Motors CWE-639 5.3 Medium 2025-08-14
CVE-2025-48277 WordPress Cost Calculator Builder plugin <= 3.2.74 - Cross Site Scripting (XSS) Vulnerability — Cost Calculator Builder CWE-79 5.9 Medium 2025-05-19
CVE-2025-32662 WordPress uListing plugin <= 2.2.0 - Deserialization of untrusted data vulnerability — uListing CWE-502 8.8 High 2025-04-17
CVE-2025-39587 WordPress Cost Calculator Builder plugin <= 3.2.65 - SQL Injection Vulnerability — Cost Calculator Builder CWE-89 9.3 Critical 2025-04-17
CVE-2025-2128 Cost Calculator Builder <= 3.2.67 - Authenticated (Subscriber+) SQL Injection via order_ids Parameter — Cost Calculator Builder CWE-89 6.5 Medium 2025-04-11
CVE-2025-32654 WordPress Motors plugin <= 1.4.71 - Local File Inclusion vulnerability — Motors CWE-98 8.1 High 2025-04-11
CVE-2025-3437 Motors – Car Dealership & Classified Listings Plugin <= 1.4.66 - Missing Authorization to Authenticated (Subscriber+) Wizard Set-up — Motors – Car Dealership & Classified Listings Plugin CWE-862 4.3 Medium 2025-04-08
CVE-2025-2807 Motors – Car Dealership & Classified Listings Plugin <= 1.4.64 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation — Motors – Car Dealership & Classified Listings Plugin CWE-862 8.8 High 2025-04-08
CVE-2025-2808 Motors – Car Dealership & Classified Listings Plugin <= 1.4.63 - Authenticated (Subscriber+) Stored Cross-Site Scripting — Motors – Car Dealership & Classified Listings Plugin CWE-79 5.4 Medium 2025-04-08
CVE-2025-32237 WordPress MasterStudy LMS plugin <= 3.5.28 - Broken Access Control vulnerability — MasterStudy LMS CWE-862 4.3 Medium 2025-04-04
CVE-2025-32170 WordPress Motors plugin <= 1.4.71 - Cross Site Scripting (XSS) vulnerability — Motors CWE-79 6.5 Medium 2025-04-04
CVE-2025-32142 WordPress Motors plugin <= 1.4.71 - Local File Inclusion vulnerability — Motors CWE-98 8.8 High 2025-04-04
CVE-2025-32141 WordPress MasterStudy LMS plugin <= 3.5.28 - Local File Inclusion vulnerability — MasterStudy LMS CWE-98 8.8 High 2025-04-04
CVE-2025-32122 WordPress uListing plugin <= 2.2.0 - SQL Injection vulnerability — uListing CWE-89 7.6 High 2025-04-04
CVE-2025-31880 WordPress Pearl plugin <= 1.3.9 - Cross Site Request Forgery (CSRF) vulnerability — Pearl CWE-352 4.3 Medium 2025-04-01
CVE-2025-31881 WordPress Pearl plugin <= 1.3.9 - Broken Access Control vulnerability — Pearl CWE-862 5.4 Medium 2025-04-01
CVE-2025-31414 WordPress Cost Calculator Builder plugin <= 3.2.65 - Cross Site Scripting (XSS) vulnerability — Cost Calculator Builder CWE-79 6.5 Medium 2025-03-31
CVE-2024-13737 Motors – Car Dealer, Classifieds & Listing <= 1.4.57 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion and Listing Template Creation — Motors – Car Dealership & Classified Listings Plugin CWE-862 4.3 Medium 2025-03-22
CVE-2025-1653 Directory Listings WordPress plugin – uListing <= 2.2.0 - Authenticated (Subscriber+) Privilege Escalation — Directory Listings WordPress plugin – uListing CWE-266 8.8 High 2025-03-15
CVE-2025-1657 Directory Listings WordPress plugin – uListing <= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Update and PHP Object Injection — Directory Listings WordPress plugin – uListing CWE-862 8.8 High 2025-03-15
CVE-2025-25150 WordPress uListing plugin <= 2.1.6 - SQL Injection vulnerability — uListing CWE-89 9.3 Critical 2025-03-03
CVE-2025-25151 WordPress uListing Plugin <= 2.1.6 - SQL Injection vulnerability — uListing CWE-89 8.5 High 2025-02-07
CVE-2024-10970 Motors – Car Dealer, Classifieds & Listing <= 1.4.43 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Custom Title — Motors – Car Dealership & Classified Listings Plugin CWE-94 5.4 Medium 2025-01-16
CVE-2024-12206 Wordpress Header Builder Plugin <= 1.3.8 - Cross-Site Request Forgery to Header Deletion — Pearl – Header Builder CWE-352 4.3 Medium 2025-01-09
CVE-2024-37093 WordPress MasterStudy LMS plugin <= 3.2.1 - Cross Site Request Forgery (CSRF) vulnerability — MasterStudy LMS CWE-352 4.3 Medium 2025-01-02
CVE-2024-47344 WordPress uListing plugin <= 2.1.5 - Sensitive Data Exposure vulnerability — uListing CWE-200 5.3 Medium 2024-10-07
CVE-2024-6012 Cost Calculator Builder <= 3.2.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Creation — Cost Calculator Builder CWE-862 4.3 Medium 2024-07-02
CVE-2024-6011 Cost Calculator Builder <= 3.2.12 - Authenticated (Administrator+) Stored Cross-Site Scripting — Cost Calculator Builder CWE-79 4.4 Medium 2024-07-02

This page lists every published CVE security advisory associated with Stylemix. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.