StylemixThemes Vulnerabilities and Affected Products
Vulnerabilities associated with uListing (WordPress plugin).
Products
Clear product- masterstudy_lms8 vulnerabilities
- MasterStudy LMS Pro7 vulnerabilities
- Consulting Elementor Widgets6 vulnerabilities
- Cost Calculator Builder PRO6 vulnerabilities
- Motors6 vulnerabilities
- uListing (WordPress plugin)6 vulnerabilities
- Masterstudy Elementor Widgets5 vulnerabilities
- consulting_elementor_widgets3 vulnerabilities
- MasterStudy LMS3 vulnerabilities
- Motors – Car Dealer, Classifieds & Listing3 vulnerabilities
- Consulting2 vulnerabilities
- Cost Calculator Builder2 vulnerabilities
- cost_calculator_builder2 vulnerabilities
- cost_calculator_builder_pro2 vulnerabilities
- eRoom – Zoom Meetings & Webinar (WordPress plugin)2 vulnerabilities
- Masterstudy2 vulnerabilities
- MasterStudy LMS WordPress Plugin – for Online Courses and Education2 vulnerabilities
- masterstudy_elementor_widgets2 vulnerabilities
- Motors - Car Dealer, Rental & Listing WordPress theme2 vulnerabilities
- Pearl - Corporate Business2 vulnerabilities
- Booking Calendar | Appointment Booking | BookIt1 vulnerability
- eRoom – Zoom Meetings & Webinar1 vulnerability
- GDPR Compliance & Cookie Consent1 vulnerability
- Masterstudy LMS Starter1 vulnerability
- MegaMenu1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2021-36880HIGH | WordPress uListing plugin <= 2.0.3 - Unauthenticated SQL Injection (SQLi) vulnerabilityUnauthenticated SQL Injection (SQLi) vulnerability in WordPress uListing plugin (versions <= 2.0.3), vulnerable parameter: custom. CWE-89Sep 27, 2021 | CVSS8.6v3.1 | EPSS2.1% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-36874HIGH | WordPress uListing plugin <= 2.0.5 - Authenticated Insecure Direct Object References (IDOR) vulnerabilityAuthenticated Insecure Direct Object References (IDOR) vulnerability in WordPress uListing plugin (versions <= 2.0.5). CWE-639Sep 27, 2021 | CVSS7.1v3.1 | EPSS1.1% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-36877MEDIUM | WordPress uListing plugin <= 2.0.5 - Modify User Roles via Cross-Site Request Forgery (CSRF) vulnerabilityCross-Site Request Forgery (CSRF) vulnerability in WordPress uListing plugin (versions <= 2.0.5) makes it possible for attackers to modify user roles. CWE-352Sep 27, 2021 | CVSS4.3v3.1 | EPSS0.442% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-36876MEDIUM | WordPress uListing plugin <= 2.0.5 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilitiesMultiple Cross-Site Request Forgery (CSRF) vulnerabilities in WordPress uListing plugin (versions <= 2.0.5) as it lacks CSRF checks on plugin administration pages. CWE-352Sep 27, 2021 | CVSS5.4v3.1 | EPSS0.443% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-36879CRITICAL | WordPress uListing plugin <= 2.0.5 - Unauthenticated Privilege Escalation vulnerabilityUnauthenticated Privilege Escalation vulnerability in WordPress uListing plugin (versions <= 2.0.5). Possible if WordPress configuration allows user registration. | CVSS9.8v3.1 | EPSS2.18% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-36878MEDIUM | WordPress uListing plugin <= 2.0.5 - Settings Update via Cross-Site Request Forgery (CSRF) vulnerabilityCross-Site Request Forgery (CSRF) vulnerability in WordPress uListing plugin (versions <= 2.0.5) makes it possible for attackers to update settings. CWE-352Sep 27, 2021 | CVSS4.3v3.1 | EPSS0.438% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |