Login Request a demo
SL
Product
Sensei LMS
by Automattic · last CVE Oct 19, 2026
9
CVEs
0
On KEV
5.4
Max CVSS
2
New 30D
Vulnerabilities9In the news0Timeline
Severity mix
Critical 0High 0Medium 9Low 0
Severity
All severities9Critical0High0Medium9Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Sensei LMS to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2023-50875
5.4
0%
Feb 12
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic Sensei LMS – Online Courses, Quizzes, & Learning allows Stored…
Affected: through 4.17.0
CVE-2025-22740
5.3
0%
Mar 27
WordPress Sensei LMS plugin <= 4.24.4 - Broken Access Control vulnerability
Affected: through 4.24.4
CVE-2025-0466
5.3
0%
Feb 4
Sensei LMS < 4.24.4 - Unauthenticated sensei_email/sensei_message Disclosure
Affected: before 4.24.4
CVE-2024-7786
5.3
2%
Sep 4
Sensei LMS < 4.24.2 - Unauthenticated Email Template Leak
Affected: before 4.24.2
CVE-2022-2034
5.3
3%
Aug 29
The Sensei LMS WordPress plugin before 4.5.0 does not have proper permissions set in one of its REST endpoint, allowing unauthenticated users to access private messages sent to…
Affected: before 4.5.0
CVE-2026-112329
4.3
0%
Oct 19
Sensei LMS 4.26.4 Broken Access Control via save_new_message
Affected: before 4.26.4
CVE-2026-112328
4.3
0%
Oct 19
Sensei LMS 4.26.4 Broken Access Control via add_new_module_term AJAX
Affected: before 4.26.4
CVE-2024-8009
4.3
0%
May 15
Sensei LMS < 4.20.0 - Teacher+ Users Email Address Disclosure
Affected: before 4.20.0
CVE-2022-2080
4.3
1%
Aug 29
The Sensei LMS WordPress plugin before 4.5.2 does not ensure that the sender of a private message is either the teacher or the original sender, allowing any authenticated user to…
Affected: before 4.5.2
Showing 9