Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

StylemixThemes — Vulnerabilities & Security Advisories 69

Browse all 69 CVE security advisories affecting StylemixThemes. AI-powered Chinese analysis, POCs, and references for each vulnerability.

StylemixThemes operates as a prominent developer of WordPress themes and plugins, primarily targeting the e-commerce and lifestyle sectors through its extensive portfolio on marketplaces like ThemeForest. The company’s software has been associated with fifty recorded Common Vulnerabilities and Exposures (CVEs), reflecting significant security challenges in its codebase. Historically, these vulnerabilities frequently manifest as remote code execution, cross-site scripting, and privilege escalation flaws, often stemming from insufficient input validation and improper access controls within plugin architectures. While no single catastrophic data breach has been publicly attributed solely to StylemixThemes, the high volume of CVEs indicates systemic issues in their development and patching processes. Users are advised to exercise caution, ensuring all components are updated to mitigate risks associated with these known exploitation vectors.

CVE ID Title CVSS Severity Published
CVE-2025-7438 MasterStudy LMS – Online Courses, eLearning PRO Plus <= 4.7.9 - Authenticated (Subscriber+) Arbitrary File Upload — MasterStudy LMS Pro CWE-434 7.5 High 2025-07-18
CVE-2025-47586 WordPress Motors - Events plugin <= 1.4.7 - Unauthenticated Local File Inclusion vulnerability — Motors - Events CWE-98 9.0 Critical 2025-06-06
CVE-2025-4800 MasterStudy LMS Pro <= 4.7.0 - Authenticated (Subscriber+) Arbitrary File Upload — MasterStudy LMS Pro CWE-434 8.8 High 2025-05-28
CVE-2025-4322 Motors <= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover — Motors - Car Dealer, Rental & Listing WordPress theme CWE-620 9.8 Critical 2025-05-20
CVE-2024-13738 Motors - Car Dealer, Rental & Listing WordPress theme <= 5.6.65 - Unauthenticated Arbitrary Shortcode Execution — Motors - Car Dealer, Rental & Listing WordPress theme CWE-94 7.3 High 2025-05-03
CVE-2025-26986 WordPress Pearl Theme < 3.4.8 - Local File Inclusion vulnerability — Pearl - Corporate Business CWE-98 8.1 High 2025-03-26
CVE-2024-11939 Cost Calculator Builder PRO <= 3.2.15 - Unauthenticated SQL Injection via data — Cost Calculator Builder PRO CWE-89 7.5 High 2025-01-08
CVE-2023-40011 WordPress Cost Calculator Builder plugin <= 3.1.42 - Broken Access Control vulnerability — Cost Calculator Builder CWE-862 5.4 Medium 2024-12-13
CVE-2022-43472 WordPress eRoom plugin <= 1.4.6 - Broken Access Control vulnerability — eRoom – Zoom Meetings & Webinar CWE-862 4.3 Medium 2024-12-13
CVE-2024-37269 WordPress Masterstudy Elementor Widgets plugin <= 1.2.2 - Unauthenticated Broken Access Control vulnerability — Masterstudy Elementor Widgets CWE-862 5.3 Medium 2024-11-01
CVE-2024-37094 WordPress MasterStudy LMS plugin <= 3.2.12 - Broken Access Control vulnerability — MasterStudy LMS CWE-862 8.2 High 2024-11-01
CVE-2024-43990 WordPress Masterstudy LMS Starter theme <= 1.1.8 - Sensitive Data Exposure vulnerability — Masterstudy LMS Starter CWE-532 5.3 Medium 2024-09-25
CVE-2024-6010 Cost Calculator Builder PRO <= 3.2.1 - Unauthenticated Price Manipulation — Cost Calculator Builder PRO CWE-472 5.3 Medium 2024-09-07
CVE-2024-43144 WordPress Cost Calculator Builder plugin <= 3.2.15 - SQL Injection vulnerability — Cost Calculator Builder CWE-89 9.3 Critical 2024-08-29
CVE-2024-37090 SQL Injection vulnerability in multiple StylemixThemes premium themes — Masterstudy Elementor Widgets CWE-89 8.5 High 2024-07-09
CVE-2024-37092 WordPress Consulting Elementor Widgets plugin <= 1.3.0 - Local File Inclusion vulnerability — Consulting Elementor Widgets CWE-22 8.5 High 2024-06-24
CVE-2024-37091 WordPress Consulting Elementor Widgets plugin <= 1.3.0 - Remote Code Execution (RCE) vulnerability — Consulting Elementor Widgets CWE-77 9.9 Critical 2024-06-24
CVE-2024-37089 WordPress Consulting Elementor Widgets plugin <= 1.3.0 - Unauthenticated Local File Inclusion vulnerability — Consulting Elementor Widgets CWE-22 9.0 Critical 2024-06-24
CVE-2024-4787 Cost Calculator Builder PRO <= 3.1.75 - Unauthenticated Arbitrary Email Sending — Cost Calculator Builder PRO CWE-20 5.8 Medium 2024-06-19
CVE-2024-35677 WordPress MegaMenu plugin <= 2.3.12 - Unauthenticated Local File Inclusion vulnerability — MegaMenu CWE-22 9.0 Critical 2024-06-10
CVE-2024-4789 Cost Calculator Builder Pro <= 3.1.72 - Authenticated (Subscriber+) Server-Side Request Forgery — Cost Calculator Builder PRO CWE-918 6.4 Medium 2024-05-17
CVE-2023-37385 WordPress Consulting theme <= 6.5.6 - Local File Inclusion — Consulting CWE-22 7.3 High 2024-05-17
CVE-2024-4097 Cost Calculator Builder Pro <= 3.1.67 - Unauthenticated Cross-Site Scripting via SVG Upload — Cost Calculator Builder PRO CWE-79 7.2 High 2024-05-02
CVE-2023-50852 WordPress BookIt Plugin <= 2.4.3 is vulnerable to SQL Injection — Booking Calendar | Appointment Booking | BookIt CWE-89 7.6 High 2023-12-28
CVE-2023-46207 WordPress Motors – Car Dealer & Classified Ads Plugin <= 1.4.6 is vulnerable to Server Side Request Forgery (SSRF) — Motors – Car Dealer, Classifieds & Listing CWE-918 4.1 Medium 2023-11-13
CVE-2023-46208 WordPress Motors – Car Dealer & Classified Ads Plugin <= 1.4.6 is vulnerable to Cross Site Scripting (XSS) — Motors – Car Dealer, Classifieds & Listing CWE-79 7.1 High 2023-10-27
CVE-2023-35093 WordPress MasterStudy LMS Plugin <= 3.0.8 is vulnerable to Broken Access Control — MasterStudy LMS WordPress Plugin – for Online Courses and Education CWE-862 6.5 Medium 2023-06-22
CVE-2023-35090 WordPress MasterStudy LMS Plugin <= 3.0.8 is vulnerable to Cross Site Scripting (XSS) — MasterStudy LMS WordPress Plugin – for Online Courses and Education CWE-79 6.5 Medium 2023-06-22
CVE-2022-45815 WordPress GDPR Compliance & Cookie Consent Plugin <= 1.2 is vulnerable to Cross Site Request Forgery (CSRF) — GDPR Compliance & Cookie Consent CWE-352 4.3 Medium 2023-05-25
CVE-2022-38716 WordPress Motors – Car Dealer & Classified Ads Plugin <= 1.4.4 is vulnerable to Cross Site Request Forgery (CSRF) — Motors – Car Dealer, Classifieds & Listing CWE-352 5.4 Medium 2023-05-25

This page lists every published CVE security advisory associated with StylemixThemes. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.