StylemixThemes Vulnerabilities and Affected Products
Vulnerabilities associated with Consulting Elementor Widgets.
Products
Clear product- masterstudy_lms8 vulnerabilities
- MasterStudy LMS Pro7 vulnerabilities
- Consulting Elementor Widgets6 vulnerabilities
- Cost Calculator Builder PRO6 vulnerabilities
- Motors6 vulnerabilities
- uListing (WordPress plugin)6 vulnerabilities
- Masterstudy Elementor Widgets5 vulnerabilities
- consulting_elementor_widgets3 vulnerabilities
- MasterStudy LMS3 vulnerabilities
- Motors – Car Dealer, Classifieds & Listing3 vulnerabilities
- Consulting2 vulnerabilities
- Cost Calculator Builder2 vulnerabilities
- cost_calculator_builder2 vulnerabilities
- cost_calculator_builder_pro2 vulnerabilities
- eRoom – Zoom Meetings & Webinar (WordPress plugin)2 vulnerabilities
- Masterstudy2 vulnerabilities
- MasterStudy LMS WordPress Plugin – for Online Courses and Education2 vulnerabilities
- masterstudy_elementor_widgets2 vulnerabilities
- Motors - Car Dealer, Rental & Listing WordPress theme2 vulnerabilities
- Pearl - Corporate Business2 vulnerabilities
- Booking Calendar | Appointment Booking | BookIt1 vulnerability
- eRoom – Zoom Meetings & Webinar1 vulnerability
- GDPR Compliance & Cookie Consent1 vulnerability
- Masterstudy LMS Starter1 vulnerability
- MegaMenu1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2025-64361MEDIUM | WordPress Consulting Elementor Widgets plugin <= 1.4.2 - Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StylemixThemes Consulting Elementor Widgets consulting-elementor-widgets allows DOM-Based XSS.This issue affects Consulting Elementor Widgets: from n/a through <= 1.4.2. CWE-79Oct 31, 2025 | CVSS6.5v3.1 | EPSS0.154% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-64360HIGH | WordPress Consulting Elementor Widgets plugin <= 1.4.2 - Local File Inclusion vulnerabilityImproper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Consulting Elementor Widgets consulting-elementor-widgets allows PHP Local File Inclusion.This issue affects Consulting Elementor Widgets: from n/a through <= 1.4.2. CWE-98Oct 31, 2025 | CVSS7.5v3.1 | EPSS0.361% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-37090HIGH | SQL Injection vulnerability in multiple StylemixThemes premium themesImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Masterstudy Elementor Widgets, StylemixThemes Consulting Elementor Widgets.This issue affects Masterstudy Elementor Widgets: from n/a through 1.2.2; Consulting Elementor Widgets: from n/a through 1.3.0. CWE-89Jul 9, 2024 | CVSS8.5v3.1 | EPSS0.53% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-37092HIGH | WordPress Consulting Elementor Widgets plugin <= 1.3.0 - Local File Inclusion vulnerabilityImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in StylemixThemes Consulting Elementor Widgets allows PHP Local File Inclusion.This issue affects Consulting Elementor Widgets: from n/a through 1.3.0. CWE-22Jun 24, 2024 | CVSS8.5v3.1 | EPSS0.525% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-37091CRITICAL | WordPress Consulting Elementor Widgets plugin <= 1.3.0 - Remote Code Execution (RCE) vulnerabilityImproper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in StylemixThemes Consulting Elementor Widgets, StylemixThemes Masterstudy Elementor Widgets allows OS Command Injection.This issue affects Consulting Elementor Widgets: from n/a through 1.3.0; Masterstudy Elementor Widgets: from n/a through 1.2.2. | CVSS9.9v3.1 | EPSS1.24% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-37089CRITICAL | WordPress Consulting Elementor Widgets plugin <= 1.3.0 - Unauthenticated Local File Inclusion vulnerabilityImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in StylemixThemes Consulting Elementor Widgets allows PHP Local File Inclusion.This issue affects Consulting Elementor Widgets: from n/a through 1.3.0. CWE-22Jun 24, 2024 | CVSS9.0v3.1 | EPSS0.609% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |