ML
Product
MasterStudy LMS WordPress Plugin
18
CVEs
0
On KEV
7.2
Max CVSS
1
New 30D
Severity mix
Critical 0High 1Medium 11Low 6
Watch
Add MasterStudy LMS WordPress Plugin to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-88843 | 7.2 | Sep 24 | MasterStudy LMS 3.5.29 - < 3.7.50 - Contributor+ LFI via Elementor Courses Categories Widget Affected: 3.5.29 before 3.7.50 |
| CVE-2026-88846 | 5.3 | Sep 24 | MasterStudy LMS 2.3.0 - < 3.7.50 - Unauthenticated Account Creation with Registration Disabled Affected: 2.3.0 before 3.7.50 |
| CVE-2026-81199 | 5.3 | Sep 2 | MasterStudy LMS < 3.7.46 - Unauthenticated Student Statistics Disclosure via student/stats REST Route Affected: before 3.7.46 |
| CVE-2026-81197 | 5.3 | Sep 2 | MasterStudy LMS < 3.7.46 - Unauthenticated Unpublished Course Title Disclosure via course-list REST Route Affected: before 3.7.46 |
| CVE-2026-81195 | 5.3 | Sep 2 | MasterStudy LMS < 3.7.46 - Unauthenticated Student Enrollment Disclosure via student-courses REST Route Affected: before 3.7.46 |
| CVE-2026-81026 | 4.8 | Aug 29 | MasterStudy LMS < 3.7.40 - Unauthenticated Payment Bypass via PayPal IPN Affected: before 3.7.40 |
| CVE-2026-81342 | 4.7 | Aug 29 | MasterStudy LMS < 3.7.43 - Unauthenticated Open Redirect Affected: before 3.7.43 |
| CVE-2026-81338 | 4.6 | Sep 23 | MasterStudy LMS < 3.7.50 - Subscriber+ Stored HTML Injection via Course Discussions Affected: before 3.7.50 |
| CVE-2026-88847 | 4.3 | Sep 24 | MasterStudy LMS < 3.7.50 - Subscriber+ Lesson Completion Record Creation Affected: before 3.7.50 |
| CVE-2026-88845 | 4.3 | Sep 24 | MasterStudy LMS 2.3.0 - < 3.7.50 - Subscriber+ Course and Lesson Creation via Demo Import Affected: 2.3.0 before 3.7.50 |
| CVE-2026-81339 | 4.3 | Sep 23 | MasterStudy LMS < 3.7.50 - Subscriber+ Quiz Attempt Grade Disclosure via IDOR Affected: before 3.7.50 |
| CVE-2026-81194 | 4.3 | Sep 2 | MasterStudy LMS < 3.7.46 - Subscriber+ Cross-Instructor Order Data Disclosure via author_id Parameter Affected: before 3.7.46 |
| CVE-2026-81340 | 3.8 | Sep 18 | MasterStudy LMS < 3.7.50 - Instructor+ Order Status Manipulation via IDOR Affected: before 3.7.50 |
| CVE-2026-81198 | 3.8 | Sep 2 | MasterStudy LMS < 3.7.46 - Instructor+ Cross-Course Curriculum Deletion and Tampering via IDOR Affected: before 3.7.46 |
| CVE-2026-88849 New | 2.7 | Oct 22 | MasterStudy LMS 3.7.13 - 3.7.54 - Instructor+ Arbitrary User Display Name Update via Student Enrollment Affected: 3.7.13 before 3.7.55 |
| CVE-2026-88844 | 2.7 | Sep 18 | MasterStudy LMS 3.6.2 - < 3.7.50 - Instructor+ Student PII Disclosure via IDOR Affected: 3.6.2 before 3.7.50 |
| CVE-2026-81196 | 2.7 | Sep 2 | MasterStudy LMS < 3.7.46 - Instructor+ Quiz Answer Disclosure via IDOR Affected: before 3.7.46 |
| CVE-2026-81200 | 2.7 | Aug 29 | MasterStudy LMS < 3.7.42 - Instructor+ Cross-Tenant Order Billing PII Disclosure via IDOR Affected: before 3.7.42 |
Showing 18