StylemixThemes Vulnerabilities and Affected Products
Vulnerabilities associated with Motors.
Products
Clear product- masterstudy_lms8 vulnerabilities
- MasterStudy LMS Pro7 vulnerabilities
- Consulting Elementor Widgets6 vulnerabilities
- Cost Calculator Builder PRO6 vulnerabilities
- Motors6 vulnerabilities
- uListing (WordPress plugin)6 vulnerabilities
- Masterstudy Elementor Widgets5 vulnerabilities
- consulting_elementor_widgets3 vulnerabilities
- MasterStudy LMS3 vulnerabilities
- Motors – Car Dealer, Classifieds & Listing3 vulnerabilities
- Consulting2 vulnerabilities
- Cost Calculator Builder2 vulnerabilities
- cost_calculator_builder2 vulnerabilities
- cost_calculator_builder_pro2 vulnerabilities
- eRoom – Zoom Meetings & Webinar (WordPress plugin)2 vulnerabilities
- Masterstudy2 vulnerabilities
- MasterStudy LMS WordPress Plugin – for Online Courses and Education2 vulnerabilities
- masterstudy_elementor_widgets2 vulnerabilities
- Motors - Car Dealer, Rental & Listing WordPress theme2 vulnerabilities
- Pearl - Corporate Business2 vulnerabilities
- Booking Calendar | Appointment Booking | BookIt1 vulnerability
- eRoom – Zoom Meetings & Webinar1 vulnerability
- GDPR Compliance & Cookie Consent1 vulnerability
- Masterstudy LMS Starter1 vulnerability
- MegaMenu1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-27433MEDIUM | WordPress Motors theme <= 5.6.80 - Broken Access Control vulnerabilityUnauthenticated Broken Access Control in Motors <= 5.6.80 versions. CWE-862Jul 2, 2026 | CVSS6.5v3.1 | EPSS0.245% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-54828HIGH | WordPress Motors plugin <= 1.4.109 - Broken Access Control vulnerabilityUnauthenticated Broken Access Control in Motors <= 1.4.109 versions. CWE-862Jun 25, 2026 | CVSS7.5v3.1 | EPSS0.238% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-54812CRITICAL | WordPress Motors plugin <= 1.4.109 - SQL Injection vulnerabilityImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Motors allows Blind SQL Injection. This issue affects Motors: from n/a through 1.4.109. CWE-89Jun 17, 2026 | CVSS9.3v3.1 | EPSS0.283% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-54814HIGH | WordPress Motors plugin <= 1.4.109 - Local File Inclusion vulnerabilityImproper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Motors allows PHP Local File Inclusion. This issue affects Motors: from n/a through 1.4.109. CWE-98Jun 17, 2026 | CVSS8.1v3.1 | EPSS0.327% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-39515MEDIUM | WordPress Motors plugin < 1.4.107 - Broken Access Control vulnerabilitySubscriber Broken Access Control in Motors < 1.4.107 versions. CWE-862Jun 15, 2026 | CVSS6.5v3.1 | EPSS0.352% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-64374CRITICAL | WordPress Motors theme <= 5.6.81 - Arbitrary File Upload vulnerabilityUnrestricted Upload of File with Dangerous Type vulnerability in StylemixThemes Motors motors allows Using Malicious Files.This issue affects Motors: from n/a through <= 5.6.81. CWE-434Dec 18, 2025 | CVSS9.9v3.1 | EPSS0.334% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |