CVE-2024-37090 - CVE House

Back to Database

Status published High CVE-2024-37090

SQL Injection vulnerability in multiple StylemixThemes premium themes

8.5 CVSS

Vulnerability Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Masterstudy Elementor Widgets, StylemixThemes Consulting Elementor Widgets.This issue affects Masterstudy Elementor Widgets: from n/a through 1.2.2; Consulting Elementor Widgets: from n/a through 1.3.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-37090

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Rafie Muhammad (Patchstack)

References

More from StylemixThemes

View All →

MasterStudy LMS – Online Courses, eLearning PRO Plus <= 4.7.9 - Authenticated (Subscriber+) Arbitrary File Upload

WordPress Splash - Sport Club WordPress theme for Basketball, Football, Hockey theme <= 4.4.3 - Local File Inclusion vulnerability

WordPress Motors theme <= 5.6.81 - Arbitrary File Upload vulnerability

WordPress Masterstudy theme < 4.8.126 - Local File Inclusion vulnerability

WordPress Consulting Elementor Widgets plugin <= 1.4.2 - Cross Site Scripting (XSS) vulnerability

Affected Vendor

StylemixThemes

View all reports →

Affected Software

Masterstudy Elementor Widgets, Consulting Elementor Widgets

Vulnerable Versions:

Unknown

Timeline

Official Publish: July 9th, 2024

Last Modified: April 28th, 2026

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1213.006 Databases

T1485 Data Destruction