# StylemixThemes vulnerabilities Source: https://junglewise.ai/threats/vendors/stylemixthemes Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 13:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/stylemixthemes.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 40 vulnerabilities in StylemixThemes: 5 in the last 7 days and 13 in the last 90 days, 3 of them critical and 0 exploited in the wild. The most recent, CVE-2026-13764, was published on 12 November 2026. 7 vulnerabilities in the last four weeks, up 133% on the four before (3). 1 critical against 0. 5 technologies have a page of their own. ## Counts - Last 7 days: 5 - Last 30 days: 9 - Last 90 days: 13 - All time: 40 (3 critical, 0 exploited in the wild) ## About StylemixThemes A developer of WordPress themes and plugins for business and education. ## Latest StylemixThemes vulnerabilities - [CVE-2026-13764: Masterstudy Education WordPress Theme privilege escalation in AJAX action](https://junglewise.ai/threats/cve-2026-13764-the-masterstudy-education-wordpress-theme-theme-for-wordpress-is) (high, CVSS 8.8, published 12 Nov 2026) - [CVE-2026-66675: StylemixThemes Motors stored cross-site scripting](https://junglewise.ai/threats/cve-2026-66675-improper-neutralization-of-input-during-web-page-generation-cross) (medium, CVSS 6.5, published 9 Nov 2026) - [CVE-2026-123467: StylemixThemes Motors broken access control](https://junglewise.ai/threats/cve-2026-123467-missing-authorization-vulnerability-in-stylemixthemes-motors) (medium, CVSS 4.3, published 7 Nov 2026) - [CVE-2026-123468: StylemixThemes Motors broken access control](https://junglewise.ai/threats/cve-2026-123468-missing-authorization-vulnerability-in-stylemixthemes-motors) (medium, CVSS 4.3, published 7 Nov 2026) - [CVE-2026-119478: StylemixThemes MasterStudy LMS content injection via XSS](https://junglewise.ai/threats/cve-2026-119478-improper-neutralization-of-script-related-html-tags-in-a-web) (medium, CVSS 4.3, published 7 Nov 2026) - [CVE-2026-118090: MasterStudy LMS PHP object injection in subscriber handling](https://junglewise.ai/threats/cve-2026-118090-subscriber-php-object-injection-in-masterstudy-lms-3-7-55) (high, CVSS 8.8, published 30 Oct 2026) - [CVE-2026-80067: MasterStudy LMS path traversal in file import](https://junglewise.ai/threats/cve-2026-80067-masterstudy-lms-plugin-for-wordpress-before-3-7-50-contains-a) (medium, CVSS 5.4, published 29 Oct 2026) - [CVE-2026-118092: StylemixThemes MasterStudy LMS broken access control](https://junglewise.ai/threats/cve-2026-118092-missing-authorization-vulnerability-in-stylemixthemes) (medium, CVSS 4.3, published 29 Oct 2026) - [CVE-2026-115964: StylemixThemes Motors SQL injection in classified listings](https://junglewise.ai/threats/cve-2026-115964-improper-neutralization-of-special-elements-used-in-an-sql) (critical, CVSS 9.3, published 29 Oct 2026) - [CVE-2026-93950: StylemixThemes Motors broken access control in theme](https://junglewise.ai/threats/cve-2026-93950-missing-authorization-vulnerability-in-stylemixthemes-motors) (high, CVSS 7.5, published 10 Oct 2026) - [CVE-2026-104399: StylemixThemes Motors sensitive data exposure in plugin](https://junglewise.ai/threats/cve-2026-104399-insertion-of-sensitive-information-into-sent-data-vulnerability) (info, published 6 Oct 2026) - [CVE-2026-97307: StylemixThemes Cost Calculator Builder sensitive data exposure](https://junglewise.ai/threats/cve-2026-97307-insertion-of-sensitive-information-into-sent-data-vulnerability) (high, CVSS 7.5, published 4 Oct 2026) - [CVE-2026-78284: MasterStudy LMS unauthenticated arbitrary file deletion](https://junglewise.ai/threats/cve-2026-78284-masterstudy-lms-unauthenticated-arbitrary-file-deletion) (high, CVSS 8.6, published 24 Aug 2026) - [CVE-2026-28145: StylemixThemes MasterStudy LMS user state manipulation](https://junglewise.ai/threats/cve-2026-28145-stylemixthemes-masterstudy-lms-user-state-manipulation) (medium, CVSS 5.3, published 31 Jul 2026) - [CVE-2026-5060: Stylemix MasterStudy LMS IDOR in stm_lms_delete_cover](https://junglewise.ai/threats/cve-2026-5060-stylemix-masterstudy-lms-idor-in-stm-lms-delete-cover) (medium, CVSS 6.5, published 29 Jul 2026) - [CVE-2026-14900: StylemixThemes Cost Calculator Builder PRO remote code execution in js_to_php](https://junglewise.ai/threats/cve-2026-14900-stylemixthemes-cost-calculator-builder-pro-remote-code-execution) (critical, CVSS 9.8, published 29 Jul 2026) - [CVE-2026-27392: StylemixThemes uListing broken access control](https://junglewise.ai/threats/cve-2026-27392-stylemixthemes-ulisting-broken-access-control) (medium, CVSS 4.3, published 23 Jul 2026) - [CVE-2026-27391: Stylemix uListing broken access control in WordPress plugin](https://junglewise.ai/threats/cve-2026-27391-stylemix-ulisting-broken-access-control-in-wordpress-plugin) (medium, CVSS 5.4, published 23 Jul 2026) - [CVE-2026-25427: DigitalME eRoom broken access control in Zoom Meetings & Webinar plugin](https://junglewise.ai/threats/cve-2026-25427-digitalme-eroom-broken-access-control-in-zoom-meetings-webinar) (medium, CVSS 5.4, published 23 Jul 2026) - [CVE-2026-25405: DigitalME eRoom SQL injection in Zoom Meetings & Webinar plugin](https://junglewise.ai/threats/cve-2026-25405-digitalme-eroom-sql-injection-in-zoom-meetings-webinar-plugin) (high, CVSS 8.5, published 23 Jul 2026) - [CVE-2026-10865: StylemixThemes Cost Calculator Builder sensitive information exposure](https://junglewise.ai/threats/cve-2026-10865-stylemixthemes-cost-calculator-builder-sensitive-information) (medium, CVSS 5.3, published 11 Jul 2026) - [CVE-2026-13114: Stylemix Motors Car Dealership Stored XSS in Comment Content](https://junglewise.ai/threats/cve-2026-13114-stylemix-motors-car-dealership-stored-xss-in-comment-content) (high, CVSS 7.2, published 11 Jul 2026) - [CVE-2026-27433: StylemixThemes Motors broken access control in WordPress theme](https://junglewise.ai/threats/cve-2026-27433-stylemixthemes-motors-broken-access-control-in-wordpress-theme) (medium, CVSS 6.5, published 2 Jul 2026) - [CVE-2026-27412: StylemixThemes Pearl Corporate Business Theme Local File Inclusion](https://junglewise.ai/threats/cve-2026-27412-stylemixthemes-pearl-corporate-business-theme-local-file) (high, CVSS 8.1, published 2 Jul 2026) - [CVE-2026-12435: Stylemix Motors Plugin authorization bypass in stm_mark_as_sold_car](https://junglewise.ai/threats/cve-2026-12435-stylemix-motors-plugin-authorization-bypass-in-stm-mark-as-sold) (medium, CVSS 4.3, published 1 Jul 2026) ## Most severe StylemixThemes vulnerabilities - [CVE-2026-14900: StylemixThemes Cost Calculator Builder PRO remote code execution in js_to_php](https://junglewise.ai/threats/cve-2026-14900-stylemixthemes-cost-calculator-builder-pro-remote-code-execution) (critical, CVSS 9.8, published 29 Jul 2026) - [CVE-2026-54812: StylemixThemes Motors Blind SQL injection](https://junglewise.ai/threats/cve-2026-54812-stylemixthemes-motors-blind-sql-injection) (critical, CVSS 9.3, published 17 Jun 2026) - [CVE-2026-115964: StylemixThemes Motors SQL injection in classified listings](https://junglewise.ai/threats/cve-2026-115964-improper-neutralization-of-special-elements-used-in-an-sql) (critical, CVSS 9.3, published 29 Oct 2026) - [CVE-2026-13764: Masterstudy Education WordPress Theme privilege escalation in AJAX action](https://junglewise.ai/threats/cve-2026-13764-the-masterstudy-education-wordpress-theme-theme-for-wordpress-is) (high, CVSS 8.8, published 12 Nov 2026) - [CVE-2026-118090: MasterStudy LMS PHP object injection in subscriber handling](https://junglewise.ai/threats/cve-2026-118090-subscriber-php-object-injection-in-masterstudy-lms-3-7-55) (high, CVSS 8.8, published 30 Oct 2026) - [CVE-2026-78284: MasterStudy LMS unauthenticated arbitrary file deletion](https://junglewise.ai/threats/cve-2026-78284-masterstudy-lms-unauthenticated-arbitrary-file-deletion) (high, CVSS 8.6, published 24 Aug 2026) - [CVE-2026-25405: DigitalME eRoom SQL injection in Zoom Meetings & Webinar plugin](https://junglewise.ai/threats/cve-2026-25405-digitalme-eroom-sql-injection-in-zoom-meetings-webinar-plugin) (high, CVSS 8.5, published 23 Jul 2026) - [CVE-2026-40766: StylemixThemes MasterStudy LMS SQL injection](https://junglewise.ai/threats/cve-2026-40766-stylemixthemes-masterstudy-lms-sql-injection) (high, CVSS 8.5, published 15 Jun 2026) - [CVE-2026-42730: Stylemix MasterStudy LMS SQL injection](https://junglewise.ai/threats/cve-2026-42730-stylemix-masterstudy-lms-sql-injection) (high, CVSS 8.5, published 27 May 2026) - [CVE-2026-54814: StylemixThemes Motors Local File Inclusion in WordPress plugin](https://junglewise.ai/threats/cve-2026-54814-stylemixthemes-motors-local-file-inclusion-in-wordpress-plugin) (high, CVSS 8.1, published 17 Jun 2026) ## Vulnerabilities per week 7 vulnerabilities in the last four weeks, up 133% on the four before (3). 1 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 1 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 1 | 0 | 0 | | 5 Oct 2026 | 2 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 4 | 1 | 0 | | 2 Nov 2026 | 3 | 0 | 0 | | 9 Nov 2026 | 2 | 0 | 0 | ## StylemixThemes technologies - [StylemixThemes MasterStudy LMS](https://junglewise.ai/threats/technologies/masterstudy-lms): 16 vulnerabilities - [StylemixThemes Motors – Car Dealership & Classified Listings](https://junglewise.ai/threats/technologies/motors-car-dealership-classified-listings): 9 vulnerabilities - [StylemixThemes Motors](https://junglewise.ai/threats/technologies/motors): 8 vulnerabilities - [StylemixThemes Cost Calculator Builder](https://junglewise.ai/threats/technologies/cost-calculator-builder): 3 vulnerabilities - [StylemixThemes uListing](https://junglewise.ai/threats/technologies/ulisting): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "StylemixThemes vulnerabilities", https://junglewise.ai/threats/vendors/stylemixthemes, 12 November 2026.