Vulnerabilidades em Stylemix
80 resultadosAnálise Vexday
Stylemix possui 29 vulnerabilidades catalogadas, com 2 classificadas como críticas, mas nenhuma sob ataque ativo conhecido até o momento. A fraqueza dominante (CWE-862 - falha de autorização) sugere problemas de controle de acesso, que demandam atenção prioritária; apenas 3 CVEs foram publicadas nos últimos 90 dias, indicando que o risco atual não está em escalada acelerada.
CVE-2025-12529HIGHCost Calculator Builder <= 3.6.3 - Unauthenticated Arbitrary File DeletionEPSS 0.5%CVE-2025-32122HIGHWordPress uListing plugin <= 2.2.0 - SQL Injection vulnerabilityEPSS 0.5%CVE-2025-1653HIGHDirectory Listings WordPress plugin – uListing <= 2.2.0 - Authenticated (Subscriber+) Privilege EscalationEPSS 0.5%CVE-2024-4000MEDIUMWordPress Header Builder Plugin – Pearl <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.5%CVE-2024-1904MEDIUMMasterStudy LMS <= 3.2.13 - Missing Authorization to Sensitive Information Exposure in search_postsEPSS 0.5%CVE-2026-4817MEDIUMMasterStudy LMS <= 3.7.25 - Authenticated (Subscriber+) Time-based Blind SQL Injection via 'order' and 'orderby' ParametersEPSS 0.5%CVE-2025-32662HIGHWordPress uListing plugin <= 2.2.0 - Deserialization of untrusted data vulnerabilityEPSS 0.5%CVE-2025-10494HIGHMotors – Car Dealership & Classified Listings Plugin <= 1.4.89 - Authenticated (Subscriber+) Arbitrary File DeletionEPSS 0.5%CVE-2025-25151HIGHWordPress uListing Plugin <= 2.1.6 - SQL Injection vulnerabilityEPSS 0.4%CVE-2024-6011MEDIUMCost Calculator Builder <= 3.2.12 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-13114HIGHMotors <= 1.4.112 - Unauthenticated Stored Cross-Site Scripting via Comment Content and User Biographical InfoEPSS 0.4%CVE-2025-1657HIGHDirectory Listings WordPress plugin – uListing <= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Update and PHP Object InjectionEPSS 0.4%CVE-2025-32237MEDIUMWordPress MasterStudy LMS plugin <= 3.5.28 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-12435MEDIUMMotors <= 1.4.111 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'stm_mark_as_sold_car' ParameterEPSS 0.4%CVE-2025-2128MEDIUMCost Calculator Builder <= 3.2.67 - Authenticated (Subscriber+) SQL Injection via order_ids ParameterEPSS 0.4%CVE-2025-25150CRITICALWordPress uListing plugin <= 2.1.6 - SQL Injection vulnerabilityEPSS 0.4%CVE-2024-6012MEDIUMCost Calculator Builder <= 3.2.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content CreationEPSS 0.4%CVE-2024-3942MEDIUMMasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.3.8 - Missing AuthorizationEPSS 0.4%CVE-2026-28138HIGHWordPress uListing plugin <= 2.2.0 - PHP Object Injection vulnerabilityEPSS 0.4%CVE-2025-32170MEDIUMWordPress Motors plugin <= 1.4.71 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%