WordPress Cost Calculator Builder plugin <= 3.2.74 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Krugov Artyom in WordPress Plugin Cost Calculator Builder versions = 3.2.74...

WordPress Cost Calculator Builder plugin <= 3.2.65 - SQL Injection Vulnerability

SQL Injection Vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Cost Calculator Builder versions = 3.2.65...

WordPress uListing plugin <= 2.2.0 - Deserialization of untrusted data vulnerability

Deserialization of untrusted data vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin uListing versions = 2.2.0...

WordPress Cost Calculator Builder plugin <= 3.2.67 - Authenticated (Subscriber+) SQL Injection via order_ids Parameter vulnerability

Authenticated Subscriber+ SQL Injection via orderids Parameter vulnerability discovered by mikemyers in WordPress Plugin Cost Calculator Builder versions = 3.2.67...

WordPress Motors plugin <= 1.4.66 - Missing Authorization to Authenticated (Subscriber+) Wizard Set-up vulnerability

Missing Authorization to Authenticated Subscriber+ Wizard Set-up vulnerability discovered by Chloe Chamberland in WordPress Plugin Motors versions = 1.4.66...

WordPress MasterStudy LMS plugin <= 3.5.28 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mika in WordPress Plugin MasterStudy LMS versions = 3.5.28...

WordPress MasterStudy LMS plugin <= 3.5.28 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by LVT-tholv2k in WordPress Plugin MasterStudy LMS versions = 3.5.28...

WordPress uListing plugin <= 2.2.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Phat RiO - Fore-Z co.ltd in WordPress Plugin uListing versions = 2.2.0...

CVE-2025-26986

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in StylemixThemes Pearl - Corporate Business pearl allows PHP Local File Inclusion.This issue affects Pearl - Corporate Business: from n/a through 3.4.8...

CVE-2025-26986

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in StylemixThemes Pearl - Corporate Business pearl allows PHP Local File Inclusion.This issue affects Pearl - Corporate Business: from n/a through 3.4.8...

CVE-2025-26986 WordPress Pearl Theme < 3.4.8 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in StylemixThemes Pearl - Corporate Business pearl allows PHP Local File Inclusion.This issue affects Pearl - Corporate Business: from n/a through 3.4.8...

CVE-2025-26986

The CVE-2025-26986 entry concerns Pearl - Corporate Business WordPress theme (StylemixThemes). Affected component is PHP code handling include/require in the WordPress/PHP environment, enabling Local File Inclusion due to improper filename control, effectively a PHP Remote File Inclusion style is...

CVE-2025-26986 WordPress Pearl Theme < 3.4.8 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in StylemixThemes Pearl - Corporate Business pearl allows PHP Local File Inclusion.This issue affects Pearl - Corporate Business: from n/a through 3.4.8...

CVE-2025-25151

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Stylemix uListing ulisting allows SQL Injection.This issue affects uListing: from n/a through = 2.1.6...

CVE-2025-25151

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Stylemix uListing ulisting allows SQL Injection.This issue affects uListing: from n/a through = 2.1.6...

CVE-2025-25151

CVE-2025-25151 describes an SQL Injection in WordPress plugin uListing (StylemixThemes) ≤ 2.1.6 due to improper neutralization of input for SQL commands. The CVSS v3.1 base metrics indicate a HIGH impact on confidentiality, LOW on availability, with NETWORK attack vector, LOW privileges required,...

CVE-2025-25151 WordPress uListing Plugin <= 2.1.6 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Stylemix uListing ulisting allows SQL Injection.This issue affects uListing: from n/a through = 2.1.6...

PT-2025-5959 · Stylemixthemes · Ulisting

Name of the Vulnerable Software and Affected Versions: StylemixThemes uListing versions 2.1.6 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows attackers to inject malicious SQL...

CVE-2024-43144

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in StylemixThemes Cost Calculator Builder allows SQL Injection.This issue affects Cost Calculator Builder: from n/a through 3.2.15...

CVE-2024-37090

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in StylemixThemes Masterstudy Elementor Widgets, StylemixThemes Consulting Elementor Widgets.This issue affects Masterstudy Elementor Widgets: from n/a through 1.2.2; Consulting Elementor Widgets: fro...