StylemixThemes vulnerabilities
We track 45 vulnerabilities in StylemixThemes products across 20 products. 45 are rated high or critical, and none are known to be exploited. The most recent was published on November 12, 2026.
Latest StylemixThemes vulnerabilities
- 9.8 Critical severity
MasterStudy LMS WordPress Plugin – for Online…: Improper Neutralization of Special Elements used in an SQL Command
The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to union based SQL Injection via the 'user' parameter of the /lms/stm-lms/order/items REST route in all versions up to, and including, 3.2.5 due to insuf
- 7.2 High severity
Booking Calendar | Appointment Booking | BookIt: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Booking Calendar | Appointment Booking | BookIt.This issue affects Booking Calendar | Appointment Booking | BookIt: from n/a through 2.4.3.
- 7.5 High severity
Motors – Car Dealer, Classifieds & Listing: Server-Side Request Forgery
Server-Side Request Forgery (SSRF) vulnerability in StylemixThemes Motors – Car Dealer, Classifieds & Listing.This issue affects Motors – Car Dealer, Classifieds & Listing: from n/a through 1.4.6.
- 9.8 Critical severity
Bookit — Booking & Appointment Calendar: Missing Authentication for Critical Functionality
The BookIt plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.3.7. This is due to insufficient verification on the user being supplied during booking an appointment through the plugin. This makes it possible for una
- 9.8 Critical severity
MasterStudy LMS – WordPress LMS Plugin: Improper Privilege Management
The MasterStudy LMS WordPress plugin before 2.7.6 does to validate some parameters given when registering a new account, allowing unauthenticated users to register as an admin