CVE-2026-19802Checkout Custom Fields Builder for WooCommerce <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation via 'plugin' Parameter Exploitation status Not known exploited Fix Affected product C Checkout Custom Fields Builder for WooCommerce Published 09/09/2026 Severity Medium CVE-2026-78284WordPress MasterStudy LMS plugin <= 3.7.42 - Arbitrary File Deletion vulnerability Exploitation status Not known exploited Fix Affected product M MasterStudy LMS Published 08/24/2026 Severity High CVE-2026-73404WordPress MasterStudy LMS plugin <= 3.7.41 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product M MasterStudy LMS Published 08/18/2026 Severity Medium CVE-2026-68568WordPress MasterStudy LMS plugin <= 3.7.41 - Privilege Escalation vulnerability Exploitation status Not known exploited Fix Affected product M MasterStudy LMS Published 08/18/2026 Severity Medium CVE-2026-66693WordPress Motors plugin <= 1.4.113 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product M Motors Published 08/13/2026 Severity Medium CVE-2026-7753Cost Calculator Builder <= 3.6.17 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure Exploitation status Not known exploited Fix Affected product C Cost Calculator Builder Published 08/05/2026 Severity Medium CVE-2026-5060MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.14 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Attachment Deletion Exploitation status Not known exploited Fix Affected product M MasterStudy LMS WordPress Plugin – for Online Courses and Education Published 07/29/2026 Severity Medium CVE-2026-27392WordPress uListing plugin <= 2.2.0 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product U uListing Published 07/23/2026 Severity Medium CVE-2026-27391WordPress uListing plugin <= 2.2.0 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product U uListing Published 07/23/2026 Severity Medium CVE-2026-10865Cost Calculator Builder <= 4.0.11 - Unauthenticated Sensitive Information Exposure of Payment Gateway Secret Keys Exploitation status Not known exploited Fix Affected product C Cost Calculator Builder Published 07/11/2026 Severity Medium CVE-2026-13114Motors <= 1.4.112 - Unauthenticated Stored Cross-Site Scripting via Comment Content and User Biographical Info Exploitation status Not known exploited Fix Affected product M Motors – Car Dealership & Classified Listings Plugin Published 07/11/2026 Severity High CVE-2026-12435Motors <= 1.4.111 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'stm_mark_as_sold_car' Parameter Exploitation status Not known exploited Fix Affected product M Motors – Car Dealership & Classified Listings Plugin Published 07/01/2026 Severity Medium CVE-2026-57330WordPress MasterStudy LMS plugin <= 3.7.27 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product M MasterStudy LMS Published 06/29/2026 Severity Medium CVE-2026-57640WordPress MasterStudy LMS plugin <= 3.7.30 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product M MasterStudy LMS Published 06/26/2026 Severity Medium CVE-2026-42730WordPress MasterStudy LMS plugin <= 3.7.29 - SQL Injection vulnerability Exploitation status Not known exploited Fix Affected product M MasterStudy LMS Published 05/27/2026 Severity High CVE-2026-3892Motors – Car Dealer, Classifieds & Listing <= 1.4.107 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_dealer_logo_path' Parameter Exploitation status Not known exploited Fix Affected product M Motors – Car Dealership & Classified Listings Plugin Published 05/14/2026 Severity High CVE-2025-14755Cost Calculator Builder <= 4.0.1 - Unauthenticated Price Manipulation and Insecure Direct Object Reference Exploitation status Not known exploited Fix Affected product C Cost Calculator Builder Published 05/13/2026 Severity Medium CVE-2026-1934Motors – Car Dealership & Classified Listings Plugin <= 1.4.103 - Missing Authorization to Authenticated (Subscriber+) Payment Bypass via 'stm_payment_status' Parameter Exploitation status Not known exploited Fix Affected product M Motors – Car Dealership & Classified Listings Plugin Published 05/12/2026 Severity Medium CVE-2026-4817MasterStudy LMS <= 3.7.25 - Authenticated (Subscriber+) Time-based Blind SQL Injection via 'order' and 'orderby' Parameters Exploitation status Not known exploited Fix Affected product M MasterStudy LMS WordPress Plugin – for Online Courses and Education Published 04/17/2026 Severity Medium CVE-2026-28078WordPress uListing plugin <= 2.2.0 - Arbitrary File Download vulnerability Exploitation status Not known exploited Fix Affected product U uListing Published 03/05/2026 Severity Medium CVE-2026-28138WordPress uListing plugin <= 2.2.0 - PHP Object Injection vulnerability Exploitation status Not known exploited Fix Affected product U uListing Published 02/26/2026 Severity High CVE-2026-0559MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'stm_lms_courses_grid_display' Shortcode Exploitation status Not known exploited Fix Affected product M MasterStudy LMS WordPress Plugin – for Online Courses and Education Published 02/14/2026 Severity Medium CVE-2025-14757Cost Calculator Builder <= 3.6.9 - Missing Authorization to Unauthenticated Payment Status Bypass Exploitation status Not known exploited Fix Affected product C Cost Calculator Builder Published 01/16/2026 Severity Medium CVE-2025-13766MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.6 Missing Authorization to Authenticated (Subscriber+) Posts and Media Creation, Modification and Deletion Exploitation status Not known exploited Fix Affected product M MasterStudy LMS WordPress Plugin – for Online Courses and Education Published 01/06/2026 Severity Medium CVE-2025-12529Cost Calculator Builder <= 3.6.3 - Unauthenticated Arbitrary File Deletion Exploitation status Not known exploited Fix Affected product C Cost Calculator Builder Published 12/02/2025 Severity High CVE-2025-62049WordPress Cost Calculator Builder plugin <= 3.5.32 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product C Cost Calculator Builder Published 11/06/2025 Severity Medium CVE-2025-64366WordPress MasterStudy LMS plugin <= 3.6.27 - SQL Injection vulnerability Exploitation status Not known exploited Fix Affected product M MasterStudy LMS Published 10/31/2025 Severity High CVE-2025-59575WordPress MasterStudy LMS plugin <= 3.6.20 - Sensitive Data Exposure vulnerability Exploitation status Not known exploited Fix Affected product M MasterStudy LMS Published 10/22/2025 Severity Medium CVE-2025-10494Motors – Car Dealership & Classified Listings Plugin <= 1.4.89 - Authenticated (Subscriber+) Arbitrary File Deletion Exploitation status Not known exploited Fix Affected product M Motors – Car Dealership & Classified Listings Plugin Published 10/08/2025 Severity High CVE-2025-9243Cost Calculator Builder <= 3.5.32 - Authenticated (Subscriber+) Missing Authorization via get_cc_orders/update_order_status Functions Exploitation status Not known exploited Fix Affected product C Cost Calculator Builder Published 10/04/2025 Severity High CVE-2025-59576WordPress MasterStudy LMS Plugin <= 3.6.20 - Broken Access Control Vulnerability Exploitation status Not known exploited Fix Affected product M MasterStudy LMS Published 09/22/2025 Severity Medium CVE-2025-59577WordPress MasterStudy LMS Plugin <= 3.6.20 - Race Condition Vulnerability Exploitation status Not known exploited Fix Affected product M MasterStudy LMS Published 09/22/2025 Severity Medium CVE-2025-54744WordPress MasterStudy LMS plugin <= 3.6.15 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product M MasterStudy LMS Published 09/05/2025 Severity Medium CVE-2025-54691WordPress Motors Plugin plugin <= 1.4.80 - Insecure Direct Object References (IDOR) Vulnerability Exploitation status Not known exploited Fix Affected product M Motors Published 08/14/2025 Severity Medium CVE-2025-48277WordPress Cost Calculator Builder plugin <= 3.2.74 - Cross Site Scripting (XSS) Vulnerability Exploitation status Not known exploited Fix Affected product C Cost Calculator Builder Published 05/19/2025 Severity Medium CVE-2025-32662WordPress uListing plugin <= 2.2.0 - Deserialization of untrusted data vulnerability Exploitation status Not known exploited Fix Affected product U uListing Published 04/17/2025 Severity High CVE-2025-39587WordPress Cost Calculator Builder plugin <= 3.2.65 - SQL Injection Vulnerability Exploitation status Not known exploited Fix Affected product C Cost Calculator Builder Published 04/17/2025 Severity Critical CVE-2025-2128Cost Calculator Builder <= 3.2.67 - Authenticated (Subscriber+) SQL Injection via order_ids Parameter Exploitation status Not known exploited Fix Affected product C Cost Calculator Builder Published 04/11/2025 Severity Medium CVE-2025-32654WordPress Motors plugin <= 1.4.71 - Local File Inclusion vulnerability Exploitation status Not known exploited Fix Affected product M Motors Published 04/11/2025 Severity High CVE-2025-3437Motors – Car Dealership & Classified Listings Plugin <= 1.4.66 - Missing Authorization to Authenticated (Subscriber+) Wizard Set-up Exploitation status Not known exploited Fix Affected product M Motors – Car Dealership & Classified Listings Plugin Published 04/08/2025 Severity Medium CVE-2025-2808Motors – Car Dealership & Classified Listings Plugin <= 1.4.63 - Authenticated (Subscriber+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product M Motors – Car Dealership & Classified Listings Plugin Published 04/08/2025 Severity Medium CVE-2025-2807Motors – Car Dealership & Classified Listings Plugin <= 1.4.64 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation Exploitation status Not known exploited Fix Affected product M Motors – Car Dealership & Classified Listings Plugin Published 04/08/2025 Severity High CVE-2025-32237WordPress MasterStudy LMS plugin <= 3.5.28 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product M MasterStudy LMS Published 04/04/2025 Severity Medium CVE-2025-32170WordPress Motors plugin <= 1.4.71 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product M Motors Published 04/04/2025 Severity Medium CVE-2025-32142WordPress Motors plugin <= 1.4.71 - Local File Inclusion vulnerability Exploitation status Not known exploited Fix Affected product M Motors Published 04/04/2025 Severity High CVE-2025-32141WordPress MasterStudy LMS plugin <= 3.5.28 - Local File Inclusion vulnerability Exploitation status Not known exploited Fix Affected product M MasterStudy LMS Published 04/04/2025 Severity High CVE-2025-32122WordPress uListing plugin <= 2.2.0 - SQL Injection vulnerability Exploitation status Not known exploited Fix Affected product U uListing Published 04/04/2025 Severity High CVE-2025-31881WordPress Pearl plugin <= 1.3.9 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product P Pearl Published 04/01/2025 Severity Medium CVE-2025-31880WordPress Pearl plugin <= 1.3.9 - Cross Site Request Forgery (CSRF) vulnerability Exploitation status Not known exploited Fix Affected product P Pearl Published 04/01/2025 Severity Medium CVE-2025-31414WordPress Cost Calculator Builder plugin <= 3.2.65 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product C Cost Calculator Builder Published 03/31/2025 Severity Medium CVE-2024-13737Motors – Car Dealer, Classifieds & Listing <= 1.4.57 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion and Listing Template Creation Exploitation status Not known exploited Fix Affected product M Motors – Car Dealership & Classified Listings Plugin Published 03/22/2025 Severity Medium CVE-2025-1653Directory Listings WordPress plugin – uListing <= 2.2.0 - Authenticated (Subscriber+) Privilege Escalation Exploitation status Not known exploited Fix Affected product D Directory Listings WordPress plugin – uListing Published 03/15/2025 Severity High CVE-2025-1657Directory Listings WordPress plugin – uListing <= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Update and PHP Object Injection Exploitation status Not known exploited Fix Affected product D Directory Listings WordPress plugin – uListing Published 03/15/2025 Severity High CVE-2025-25150WordPress uListing plugin <= 2.1.6 - SQL Injection vulnerability Exploitation status Not known exploited Fix Affected product U uListing Published 03/03/2025 Severity Critical CVE-2025-25151WordPress uListing Plugin <= 2.1.6 - SQL Injection vulnerability Exploitation status Not known exploited Fix Affected product U uListing Published 02/07/2025 Severity High CVE-2024-10970Motors – Car Dealer, Classifieds & Listing <= 1.4.43 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Custom Title Exploitation status Not known exploited Fix Affected product M Motors – Car Dealership & Classified Listings Plugin Published 01/16/2025 Severity Medium CVE-2024-12206Wordpress Header Builder Plugin <= 1.3.8 - Cross-Site Request Forgery to Header Deletion Exploitation status Not known exploited Fix Affected product P Pearl – Header Builder Published 01/09/2025 Severity Medium CVE-2024-37093WordPress MasterStudy LMS plugin <= 3.2.1 - Cross Site Request Forgery (CSRF) vulnerability Exploitation status Not known exploited Fix Affected product M MasterStudy LMS Published 01/02/2025 Severity Medium CVE-2023-40011WordPress Cost Calculator Builder plugin <= 3.1.42 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product C Cost Calculator Builder Published 12/13/2024 Severity Medium CVE-2024-47344WordPress uListing plugin <= 2.1.5 - Sensitive Data Exposure vulnerability Exploitation status Not known exploited Fix Affected product U uListing Published 10/07/2024 Severity Medium CVE-2024-6012Cost Calculator Builder <= 3.2.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Creation Exploitation status Not known exploited Fix Affected product C Cost Calculator Builder Published 07/02/2024 Severity Medium CVE-2024-6011Cost Calculator Builder <= 3.2.12 - Authenticated (Administrator+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product C Cost Calculator Builder Published 07/02/2024 Severity Medium CVE-2024-5545Motors – Car Dealer, Classifieds & Listing <= 1.4.9 - Missing Authorization Exploitation status Not known exploited Fix Affected product M Motors – Car Dealership & Classified Listings Plugin Published 07/02/2024 Severity Medium CVE-2024-5468WordPress Header Builder Plugin – Pearl <= 1.3.7 - Missing Authorization to Unauthenticated Arbitrary Site Options Deletion Exploitation status Not known exploited Fix Affected product P Pearl – Header Builder Published 06/12/2024 Severity Medium CVE-2024-4000WordPress Header Builder Plugin – Pearl <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Exploitation status Not known exploited Fix Affected product P Pearl – Header Builder Published 05/02/2024 Severity Medium CVE-2024-3942MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.3.8 - Missing Authorization Exploitation status Not known exploited Fix Affected product M MasterStudy LMS WordPress Plugin – for Online Courses and Education Published 05/02/2024 Severity Medium CVE-2024-3275eRoom – Zoom Meetings & Webinar <= 1.4.18 - Missing Authorization to Information Exposure Exploitation status Not known exploited Fix Affected product E eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams Published 05/02/2024 Severity Medium CVE-2024-3136MasterStudy LMS <= 3.3.3 - Unauthenticated Local File Inclusion via template Exploitation status Not known exploited Fix Affected product M MasterStudy LMS WordPress Plugin – for Online Courses and Education Published 04/09/2024 Severity Critical CVE-2024-1904MasterStudy LMS <= 3.2.13 - Missing Authorization to Sensitive Information Exposure in search_posts Exploitation status Not known exploited Fix Affected product M MasterStudy LMS WordPress Plugin – for Online Courses and Education Published 04/09/2024 Severity Medium CVE-2024-2411MasterStudy LMS <= 3.3.0 - Unauthenticated Local File Inclusion via modal Exploitation status Not known exploited Fix Affected product M MasterStudy LMS WordPress Plugin – for Online Courses and Education Published 03/29/2024 Severity Critical CVE-2024-2409MasterStudy LMS <= 3.3.1 - Unauthenticated Privilege Escalation via stm_lms_register AJAX Action Exploitation status Not known exploited Fix Affected product M MasterStudy LMS WordPress Plugin – for Online Courses and Education Published 03/29/2024 Severity Critical CVE-2024-2106MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.2.10 - Basic Information Exposure via REST route Exploitation status Not known exploited Fix Affected product M MasterStudy LMS WordPress Plugin – for Online Courses and Education Published 03/13/2024 Severity Medium CVE-2024-1512MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.2.5 - Unauthenticated SQL Injection Exploitation status Not known exploited Fix Affected product M MasterStudy LMS WordPress Plugin – for Online Courses and Education Published 02/17/2024 Severity Critical CVE-2023-2834BookIt <= 2.3.7 - Authentication Bypass Exploitation status Public exploit Fix Affected product B Bookit — Booking & Appointment Calendar Published 06/30/2023 Severity Critical CVE-2021-4381uListing <= 1.6.6 - Unauthenticated Options Changes via wp_route Exploitation status Not known exploited Fix Affected product D Directory Listings WordPress plugin – uListing Published 06/07/2023 Severity Critical CVE-2021-4370uListing <= 1.6.6 - Missing Authorization Exploitation status Not known exploited Fix Affected product D Directory Listings WordPress plugin – uListing Published 06/07/2023 Severity Critical CVE-2021-4357uListing <= 1.6.6 - Unauthenticated Arbitrary Post/Page Deletion Exploitation status Not known exploited Fix Affected product D Directory Listings WordPress plugin – uListing Published 06/07/2023 Severity Critical CVE-2021-4345uListing <= 1.6.6 - Unauthenticated Arbitrary Roles and Capabilities Creation/Deletion Exploitation status Not known exploited Fix Affected product D Directory Listings WordPress plugin – uListing Published 06/07/2023 Severity Medium CVE-2021-4346uListing <= 1.6.6 - Unauthenticated Arbitrary Account Changes Exploitation status Not known exploited Fix Affected product D Directory Listings WordPress plugin – uListing Published 06/07/2023 Severity Critical CVE-2021-4343uListing <= 1.6.6 - Unauthenticated Arbitrary Account Creation Exploitation status Not known exploited Fix Affected product D Directory Listings WordPress plugin – uListing Published 06/07/2023 Severity Critical CVE-2021-4341uListing <= 1.6.6 - Unauthenticated Wordpress Options Changes via AJAX Exploitation status Not known exploited Fix Affected product D Directory Listings WordPress plugin – uListing Published 06/07/2023 Severity Critical CVE-2021-4340uListing <= 1.6.6 - Unauthenticated SQL Injection Exploitation status Not known exploited Fix Affected product D Directory Listings WordPress plugin – uListing Published 06/07/2023 Severity Critical CVE-2021-4339uListing <= 1.6.6 - Unauthenticated Information Disclosure Exploitation status Not known exploited Fix Affected product D Directory Listings WordPress plugin – uListing Published 06/07/2023 Severity High CVE-2021-36875WordPress uListing plugin <= 2.0.5 - Auth. Reflected Cross-Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product D Directory Listings WordPress plugin – uListing Published 09/27/2021 Severity Medium 
