CVE-2026-28145WordPress MasterStudy LMS plugin <= 3.7.39 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product M MasterStudy LMS Published 07/31/2026 Severity Medium CVE-2026-14900Cost Calculator Builder PRO <= 4.0.3 - Unauthenticated Remote Code Execution via 'orderDetails' Parameter Exploitation status Not known exploited Fix Affected product C Cost Calculator Builder PRO Published 07/29/2026 Severity Critical CVE-2026-27433WordPress Motors theme <= 5.6.80 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product M Motors Published 07/02/2026 Severity Medium CVE-2026-27412WordPress Pearl - Corporate Business theme <= 3.4.10 - Local File Inclusion vulnerability Exploitation status Not known exploited Fix Affected product P Pearl - Corporate Business Published 07/02/2026 Severity High CVE-2025-68063WordPress Splash - Sport Club WordPress theme for Basketball, Football, Hockey theme <= 4.4.3 - Local File Inclusion vulnerability Exploitation status Not known exploited Fix Affected product S Splash - Sport Club WordPress Theme for Basketball, Football, Hockey Published 06/26/2026 Severity High CVE-2026-54828WordPress Motors plugin <= 1.4.109 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product M Motors Published 06/25/2026 Severity High CVE-2026-54812WordPress Motors plugin <= 1.4.109 - SQL Injection vulnerability Exploitation status Not known exploited Fix Affected product M Motors Published 06/17/2026 Severity Critical CVE-2026-54814WordPress Motors plugin <= 1.4.109 - Local File Inclusion vulnerability Exploitation status Not known exploited Fix Affected product M Motors Published 06/17/2026 Severity High CVE-2026-40766WordPress MasterStudy LMS plugin <= 3.7.25 - SQL Injection vulnerability Exploitation status Not known exploited Fix Affected product M MasterStudy LMS Published 06/15/2026 Severity High CVE-2026-39515WordPress Motors plugin < 1.4.107 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product M Motors Published 06/15/2026 Severity Medium CVE-2025-64215WordPress MasterStudy LMS Pro plugin < 4.7.16 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product M MasterStudy LMS Pro Published 06/15/2026 Severity Medium CVE-2026-8653MasterStudy LMS Pro Plus <= 4.8.20 - Authenticated (Instructor+) SQL Injection via 'columns' Parameter Exploitation status Not known exploited Fix Affected product M MasterStudy LMS Pro Published 06/04/2026 Severity Medium CVE-2025-14757Cost Calculator Builder <= 3.6.9 - Missing Authorization to Unauthenticated Payment Status Bypass Exploitation status Not known exploited Fix Affected product C Cost Calculator Builder Published 01/16/2026 Severity Medium CVE-2025-64374WordPress Motors theme <= 5.6.81 - Arbitrary File Upload vulnerability Exploitation status Not known exploited Fix Affected product M Motors Published 12/18/2025 Severity Critical CVE-2025-64214WordPress MasterStudy LMS Pro plugin < 4.7.16 - Arbitrary Content Deletion vulnerability Exploitation status Not known exploited Fix Affected product M MasterStudy LMS Pro Published 12/18/2025 Severity High CVE-2025-64213WordPress MasterStudy LMS Pro plugin < 4.7.16 - Sensitive Data Exposure vulnerability Exploitation status Not known exploited Fix Affected product M MasterStudy LMS Pro Published 12/18/2025 Severity High CVE-2025-64209WordPress Masterstudy theme < 4.8.122 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product M Masterstudy Published 12/18/2025 Severity High CVE-2025-64364WordPress Masterstudy theme < 4.8.126 - Local File Inclusion vulnerability Exploitation status Not known exploited Fix Affected product M Masterstudy Published 10/31/2025 Severity High CVE-2025-64361WordPress Consulting Elementor Widgets plugin <= 1.4.2 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product C Consulting Elementor Widgets Published 10/31/2025 Severity Medium CVE-2025-64360WordPress Consulting Elementor Widgets plugin <= 1.4.2 - Local File Inclusion vulnerability Exploitation status Not known exploited Fix Affected product C Consulting Elementor Widgets Published 10/31/2025 Severity High CVE-2025-64359WordPress Consulting theme < 6.7.5 - Local File Inclusion vulnerability Exploitation status Not known exploited Fix Affected product C Consulting Published 10/31/2025 Severity High CVE-2025-64212WordPress MasterStudy LMS Pro plugin < 4.7.16 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product M MasterStudy LMS Pro Published 10/29/2025 Severity Medium CVE-2025-64211WordPress Masterstudy Elementor Widgets plugin <= 1.2.4 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product M Masterstudy Elementor Widgets Published 10/29/2025 Severity Medium CVE-2025-64210WordPress Masterstudy Elementor Widgets plugin <= 1.2.4 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product M Masterstudy Elementor Widgets Published 10/29/2025 Severity Medium CVE-2025-7438MasterStudy LMS – Online Courses, eLearning PRO Plus <= 4.7.9 - Authenticated (Subscriber+) Arbitrary File Upload Exploitation status Not known exploited Fix Affected product M MasterStudy LMS Pro Published 07/18/2025 Severity High CVE-2025-47586WordPress Motors - Events plugin <= 1.4.7 - Unauthenticated Local File Inclusion vulnerability Exploitation status Not known exploited Fix Affected product M Motors - Events Published 06/06/2025 Severity Critical CVE-2025-4800MasterStudy LMS Pro <= 4.7.0 - Authenticated (Subscriber+) Arbitrary File Upload Exploitation status Not known exploited Fix Affected product M MasterStudy LMS Pro Published 05/28/2025 Severity High CVE-2025-4322Motors <= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover Exploitation status Not known exploited Fix Affected product M Motors - Car Dealer, Rental & Listing WordPress theme Published 05/20/2025 Severity Critical CVE-2024-13738Motors - Car Dealer, Rental & Listing WordPress theme <= 5.6.65 - Unauthenticated Arbitrary Shortcode Execution Exploitation status Not known exploited Fix Affected product M Motors - Car Dealer, Rental & Listing WordPress theme Published 05/03/2025 Severity High CVE-2025-3437Motors – Car Dealership & Classified Listings Plugin <= 1.4.66 - Missing Authorization to Authenticated (Subscriber+) Wizard Set-up Exploitation status Not known exploited Fix Affected product M Motors – Car Dealership & Classified Listings Plugin Published 04/08/2025 Severity Medium CVE-2025-2808Motors – Car Dealership & Classified Listings Plugin <= 1.4.63 - Authenticated (Subscriber+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product M Motors – Car Dealership & Classified Listings Plugin Published 04/08/2025 Severity Medium CVE-2025-2807Motors – Car Dealership & Classified Listings Plugin <= 1.4.64 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation Exploitation status Not known exploited Fix Affected product M Motors – Car Dealership & Classified Listings Plugin Published 04/08/2025 Severity High CVE-2025-26986WordPress Pearl Theme < 3.4.8 - Local File Inclusion vulnerability Exploitation status Not known exploited Fix Affected product P Pearl - Corporate Business Published 03/26/2025 Severity High CVE-2024-13737Motors – Car Dealer, Classifieds & Listing <= 1.4.57 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion and Listing Template Creation Exploitation status Not known exploited Fix Affected product M Motors – Car Dealership & Classified Listings Plugin Published 03/22/2025 Severity Medium CVE-2025-1653Directory Listings WordPress plugin – uListing <= 2.2.0 - Authenticated (Subscriber+) Privilege Escalation Exploitation status Not known exploited Fix Affected product D Directory Listings WordPress plugin – uListing Published 03/15/2025 Severity High CVE-2025-1657Directory Listings WordPress plugin – uListing <= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Update and PHP Object Injection Exploitation status Not known exploited Fix Affected product D Directory Listings WordPress plugin – uListing Published 03/15/2025 Severity High CVE-2025-25151WordPress uListing Plugin <= 2.1.6 - SQL Injection vulnerability Exploitation status Not known exploited Fix Affected product U uListing Published 02/07/2025 Severity High CVE-2024-10970Motors – Car Dealer, Classifieds & Listing <= 1.4.43 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Custom Title Exploitation status Not known exploited Fix Affected product M Motors – Car Dealership & Classified Listings Plugin Published 01/16/2025 Severity Medium CVE-2024-11939Cost Calculator Builder PRO <= 3.2.15 - Unauthenticated SQL Injection via data Exploitation status Not known exploited Fix Affected product C Cost Calculator Builder PRO Published 01/08/2025 Severity High CVE-2024-37093WordPress MasterStudy LMS plugin <= 3.2.1 - Cross Site Request Forgery (CSRF) vulnerability Exploitation status Not known exploited Fix Affected product M MasterStudy LMS Published 01/02/2025 Severity Medium CVE-2024-10892Cost Calculator Builder < 3.2.43 - Settings update via CSRF Exploitation status Public exploit Fix Affected product C Cost Calculator Builder Published 12/18/2024 Severity Medium CVE-2023-40011WordPress Cost Calculator Builder plugin <= 3.1.42 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product C Cost Calculator Builder Published 12/13/2024 Severity Medium CVE-2022-43472WordPress eRoom plugin <= 1.4.6 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product E eRoom – Zoom Meetings & Webinar Published 12/13/2024 Severity Medium CVE-2024-37269WordPress Masterstudy Elementor Widgets plugin <= 1.2.2 - Unauthenticated Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product M Masterstudy Elementor Widgets Published 11/01/2024 Severity Medium CVE-2024-37094WordPress MasterStudy LMS plugin <= 3.2.12 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product M MasterStudy LMS Published 11/01/2024 Severity High CVE-2024-47344WordPress uListing plugin <= 2.1.5 - Sensitive Data Exposure vulnerability Exploitation status Not known exploited Fix Affected product U uListing Published 10/07/2024 Severity Medium CVE-2024-8379Cost Calculator Builder < 3.2.29 - Admin+ SQL Injection Exploitation status Public exploit Fix Affected product C Cost Calculator Builder Published 09/30/2024 Severity High CVE-2024-43990WordPress Masterstudy LMS Starter theme <= 1.1.8 - Sensitive Data Exposure vulnerability Exploitation status Not known exploited Fix Affected product M Masterstudy LMS Starter Published 09/25/2024 Severity Medium CVE-2024-6010Cost Calculator Builder PRO <= 3.2.1 - Unauthenticated Price Manipulation Exploitation status Not known exploited Fix Affected product C Cost Calculator Builder PRO Published 09/07/2024 Severity Medium CVE-2024-43144WordPress Cost Calculator Builder plugin <= 3.2.15 - SQL Injection vulnerability Exploitation status Not known exploited Fix Affected product C Cost Calculator Builder Published 08/29/2024 Severity Critical CVE-2024-5973MasterStudy LMS < 3.3.24 - Privilege Escalation to Instructor Exploitation status Public exploit Fix Affected product M MasterStudy LMS WordPress Plugin Published 07/22/2024 Severity Critical CVE-2024-37090SQL Injection vulnerability in multiple StylemixThemes premium themes Exploitation status Not known exploited Fix Affected product M Masterstudy Elementor Widgets Published 07/09/2024 Severity High CVE-2024-6012Cost Calculator Builder <= 3.2.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Creation Exploitation status Not known exploited Fix Affected product C Cost Calculator Builder Published 07/02/2024 Severity Medium CVE-2024-6011Cost Calculator Builder <= 3.2.12 - Authenticated (Administrator+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product C Cost Calculator Builder Published 07/02/2024 Severity Medium CVE-2024-5545Motors – Car Dealer, Classifieds & Listing <= 1.4.9 - Missing Authorization Exploitation status Not known exploited Fix Affected product M Motors – Car Dealership & Classified Listings Plugin Published 07/02/2024 Severity Medium CVE-2024-37092WordPress Consulting Elementor Widgets plugin <= 1.3.0 - Local File Inclusion vulnerability Exploitation status Not known exploited Fix Affected product C Consulting Elementor Widgets Published 06/24/2024 Severity High CVE-2024-37091WordPress Consulting Elementor Widgets plugin <= 1.3.0 - Remote Code Execution (RCE) vulnerability Exploitation status Public exploit Fix Affected product C Consulting Elementor Widgets Published 06/24/2024 Severity Critical CVE-2024-37089WordPress Consulting Elementor Widgets plugin <= 1.3.0 - Unauthenticated Local File Inclusion vulnerability Exploitation status Public exploit Fix Affected product C Consulting Elementor Widgets Published 06/24/2024 Severity Critical CVE-2024-4787Cost Calculator Builder PRO <= 3.1.75 - Unauthenticated Arbitrary Email Sending Exploitation status Not known exploited Fix Affected product C Cost Calculator Builder PRO Published 06/19/2024 Severity Medium CVE-2024-35677WordPress MegaMenu plugin <= 2.3.12 - Unauthenticated Local File Inclusion vulnerability Exploitation status Not known exploited Fix Affected product M MegaMenu Published 06/10/2024 Severity Critical CVE-2024-4789Cost Calculator Builder Pro <= 3.1.72 - Authenticated (Subscriber+) Server-Side Request Forgery Exploitation status Not known exploited Fix Affected product C Cost Calculator Builder PRO Published 05/17/2024 Severity Medium CVE-2023-37385WordPress Consulting theme <= 6.5.6 - Local File Inclusion Exploitation status Not known exploited Fix Affected product C Consulting Published 05/17/2024 Severity High CVE-2024-4097Cost Calculator Builder Pro <= 3.1.67 - Unauthenticated Cross-Site Scripting via SVG Upload Exploitation status Not known exploited Fix Affected product C Cost Calculator Builder PRO Published 05/02/2024 Severity High CVE-2024-3942MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.3.8 - Missing Authorization Exploitation status Not known exploited Fix Affected product M MasterStudy LMS WordPress Plugin – for Online Courses and Education Published 05/02/2024 Severity Medium CVE-2024-3136MasterStudy LMS <= 3.3.3 - Unauthenticated Local File Inclusion via template Exploitation status Not known exploited Fix Affected product M MasterStudy LMS WordPress Plugin – for Online Courses and Education Published 04/09/2024 Severity Critical CVE-2024-1904MasterStudy LMS <= 3.2.13 - Missing Authorization to Sensitive Information Exposure in search_posts Exploitation status Not known exploited Fix Affected product M MasterStudy LMS WordPress Plugin – for Online Courses and Education Published 04/09/2024 Severity Medium CVE-2024-2411MasterStudy LMS <= 3.3.0 - Unauthenticated Local File Inclusion via modal Exploitation status Not known exploited Fix Affected product M MasterStudy LMS WordPress Plugin – for Online Courses and Education Published 03/29/2024 Severity Critical CVE-2024-2409MasterStudy LMS <= 3.3.1 - Unauthenticated Privilege Escalation via stm_lms_register AJAX Action Exploitation status Not known exploited Fix Affected product M MasterStudy LMS WordPress Plugin – for Online Courses and Education Published 03/29/2024 Severity Critical CVE-2024-2106MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.2.10 - Basic Information Exposure via REST route Exploitation status Not known exploited Fix Affected product M MasterStudy LMS WordPress Plugin – for Online Courses and Education Published 03/13/2024 Severity Medium CVE-2024-1512MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.2.5 - Unauthenticated SQL Injection Exploitation status Not known exploited Fix Affected product M MasterStudy LMS WordPress Plugin – for Online Courses and Education Published 02/17/2024 Severity Critical CVE-2023-50852WordPress BookIt Plugin <= 2.4.3 is vulnerable to SQL Injection Exploitation status Not confirmed Fix Affected product B Booking Calendar | Appointment Booking | BookIt Published 12/28/2023 Severity High CVE-2023-46207WordPress Motors – Car Dealer & Classified Ads Plugin <= 1.4.6 is vulnerable to Server Side Request Forgery (SSRF) Exploitation status Not known exploited Fix Affected product M Motors – Car Dealer, Classifieds & Listing Published 11/13/2023 Severity Medium CVE-2023-46208WordPress Motors – Car Dealer & Classified Ads Plugin <= 1.4.6 is vulnerable to Cross Site Scripting (XSS) Exploitation status Not known exploited Fix Affected product M Motors – Car Dealer, Classifieds & Listing Published 10/27/2023 Severity High CVE-2023-4278MasterStudy LMS < 3.0.18 - Unauthenticated Instructor Account Creation Exploitation status Public exploit Fix Affected product M MasterStudy LMS WordPress Plugin Published 09/11/2023 Severity High CVE-2023-2834BookIt <= 2.3.7 - Authentication Bypass Exploitation status Public exploit Fix Affected product B Bookit — Booking & Appointment Calendar Published 06/30/2023 Severity Critical CVE-2023-35093WordPress MasterStudy LMS Plugin <= 3.0.8 is vulnerable to Broken Access Control Exploitation status Not known exploited Fix Affected product M MasterStudy LMS WordPress Plugin – for Online Courses and Education Published 06/22/2023 Severity Medium CVE-2023-35090WordPress MasterStudy LMS Plugin <= 3.0.8 is vulnerable to Cross Site Scripting (XSS) Exploitation status Not confirmed Fix Affected product M MasterStudy LMS WordPress Plugin – for Online Courses and Education Published 06/22/2023 Severity Medium CVE-2021-4381uListing <= 1.6.6 - Unauthenticated Options Changes via wp_route Exploitation status Not known exploited Fix Affected product D Directory Listings WordPress plugin – uListing Published 06/07/2023 Severity Critical CVE-2021-4370uListing <= 1.6.6 - Missing Authorization Exploitation status Not known exploited Fix Affected product D Directory Listings WordPress plugin – uListing Published 06/07/2023 Severity Critical CVE-2021-4357uListing <= 1.6.6 - Unauthenticated Arbitrary Post/Page Deletion Exploitation status Not known exploited Fix Affected product D Directory Listings WordPress plugin – uListing Published 06/07/2023 Severity Critical CVE-2021-4345uListing <= 1.6.6 - Unauthenticated Arbitrary Roles and Capabilities Creation/Deletion Exploitation status Not known exploited Fix Affected product D Directory Listings WordPress plugin – uListing Published 06/07/2023 Severity Medium CVE-2021-4346uListing <= 1.6.6 - Unauthenticated Arbitrary Account Changes Exploitation status Not known exploited Fix Affected product D Directory Listings WordPress plugin – uListing Published 06/07/2023 Severity Critical CVE-2021-4343uListing <= 1.6.6 - Unauthenticated Arbitrary Account Creation Exploitation status Not known exploited Fix Affected product D Directory Listings WordPress plugin – uListing Published 06/07/2023 Severity Critical CVE-2021-4341uListing <= 1.6.6 - Unauthenticated Wordpress Options Changes via AJAX Exploitation status Not known exploited Fix Affected product D Directory Listings WordPress plugin – uListing Published 06/07/2023 Severity Critical CVE-2021-4340uListing <= 1.6.6 - Unauthenticated SQL Injection Exploitation status Not known exploited Fix Affected product D Directory Listings WordPress plugin – uListing Published 06/07/2023 Severity Critical CVE-2021-4339uListing <= 1.6.6 - Unauthenticated Information Disclosure Exploitation status Not known exploited Fix Affected product D Directory Listings WordPress plugin – uListing Published 06/07/2023 Severity High CVE-2022-45815WordPress GDPR Compliance & Cookie Consent Plugin <= 1.2 is vulnerable to Cross Site Request Forgery (CSRF) Exploitation status Not known exploited Fix Affected product G GDPR Compliance & Cookie Consent Published 05/25/2023 Severity Medium CVE-2022-38716WordPress Motors – Car Dealer & Classified Ads Plugin <= 1.4.4 is vulnerable to Cross Site Request Forgery (CSRF) Exploitation status Not known exploited Fix Affected product M Motors – Car Dealer, Classifieds & Listing Published 05/25/2023 Severity Medium CVE-2022-38356WordPress Pearl Plugin <= 1.3.4 is vulnerable to Cross Site Request Forgery (CSRF) Exploitation status Not known exploited Fix Affected product W WordPress Header Builder Plugin – Pearl Published 05/25/2023 Severity Medium CVE-2022-3989Motors - Car Dealer, Classifieds & Listing < 1.4.4 - Arbitrary File Upload Exploitation status Public exploit Fix Affected product M Motors Published 12/12/2022 Severity High CVE-2022-25614WordPress eRoom plugin <= 1.3.7 - Cross-Site Request Forgery (CSRF) leading to Sync with Zoom Meetings vulnerability Exploitation status Not known exploited Fix Affected product E eRoom – Zoom Meetings & Webinar (WordPress plugin) Published 04/11/2022 Severity Medium CVE-2022-25615WordPress eRoom plugin <= 1.3.8 - Cross-Site Request Forgery (CSRF) vulnerability leading to Cache Deletion Exploitation status Not known exploited Fix Affected product E eRoom – Zoom Meetings & Webinar (WordPress plugin) Published 04/11/2022 Severity Medium CVE-2022-0441MasterStudy LMS < 2.7.6 - Unauthenticated Admin Account Creation Exploitation status Not confirmed Fix Affected product M MasterStudy LMS – WordPress LMS Plugin Published 03/07/2022 Severity Unknown CVE-2021-36875WordPress uListing plugin <= 2.0.5 - Auth. Reflected Cross-Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product D Directory Listings WordPress plugin – uListing Published 09/27/2021 Severity Medium CVE-2021-36880WordPress uListing plugin <= 2.0.3 - Unauthenticated SQL Injection (SQLi) vulnerability Exploitation status Not known exploited Fix Affected product U uListing (WordPress plugin) Published 09/27/2021 Severity High CVE-2021-36874WordPress uListing plugin <= 2.0.5 - Authenticated Insecure Direct Object References (IDOR) vulnerability Exploitation status Not known exploited Fix Affected product U uListing (WordPress plugin) Published 09/27/2021 Severity High CVE-2021-36877WordPress uListing plugin <= 2.0.5 - Modify User Roles via Cross-Site Request Forgery (CSRF) vulnerability Exploitation status Not known exploited Fix Affected product U uListing (WordPress plugin) Published 09/27/2021 Severity Medium CVE-2021-36876WordPress uListing plugin <= 2.0.5 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities Exploitation status Not known exploited Fix Affected product U uListing (WordPress plugin) Published 09/27/2021 Severity Medium CVE-2021-36879WordPress uListing plugin <= 2.0.5 - Unauthenticated Privilege Escalation vulnerability Exploitation status Not known exploited Fix Affected product U uListing (WordPress plugin) Published 09/27/2021 Severity Critical CVE-2021-36878WordPress uListing plugin <= 2.0.5 - Settings Update via Cross-Site Request Forgery (CSRF) vulnerability Exploitation status Not known exploited Fix Affected product U uListing (WordPress plugin) Published 09/27/2021 Severity Medium 
.svg){kind=icon}
.svg){kind=icon}
