WordPress Vulnerability Database

Threat Entry Updated 2026-11-07

Masterstudy Lms Learning Management System - Security Vulnerability (CVE-2026-119478)

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-management-system allows Code Injection.This issue affects MasterStudy LMS: from n/a through 3.7.56.

PLUGIN Masterstudy Lms Learning Management System

CVE-2026-119478

MEDIUM CVSS 4.3 2026-11-07

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-10-30

Masterstudy Lms Learning Management System - Security Vulnerability (CVE-2026-118090)

Subscriber PHP Object Injection in MasterStudy LMS

PLUGIN Masterstudy Lms Learning Management System

CVE-2026-118090

HIGH CVSS 8.8 2026-10-30

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-11-02

Masterstudy Lms Learning Management System - Security Vulnerability (CVE-2026-80069)

MasterStudy LMS plugin for WordPress before 3.7.50 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to trigger the stm_lms_send_test_email_ajax AJAX action without capability or nonce validation. Attackers can invoke this handler directly or via cross-site request forgery to cause an uncaught PHP fatal error that, when display_errors is enabled, discloses the absolute filesystem path of the plugin.

PLUGIN Masterstudy Lms Learning Management System

CVE-2026-80069

MEDIUM CVSS 5.3 2026-10-29

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-10-10

Masterstudy Lms Learning Management System - Security Vulnerability (CVE-2026-105079)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-management-system allows Stored XSS.This issue affects MasterStudy LMS: from n/a through 3.7.52.

PLUGIN Masterstudy Lms Learning Management System

CVE-2026-105079

MEDIUM CVSS 6.5 2026-10-08

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-10-12

Masterstudy Lms Learning Management System - Security Vulnerability (CVE-2026-78284)

Unauthenticated Arbitrary File Deletion in MasterStudy LMS

PLUGIN Masterstudy Lms Learning Management System

CVE-2026-78284

HIGH CVSS 8.6 2026-08-24

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-10-22

Masterstudy Lms Learning Management System - Broken Access Control (CVE-2026-73404)

Subscriber Broken Access Control in MasterStudy LMS

PLUGIN Masterstudy Lms Learning Management System

CVE-2026-73404

MEDIUM CVSS 6.5 2026-08-18

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-10-22

Masterstudy Lms Learning Management System - Privilege Escalation (CVE-2026-68568)

Subscriber Privilege Escalation in MasterStudy LMS

PLUGIN Masterstudy Lms Learning Management System

CVE-2026-68568

MEDIUM CVSS 6.3 2026-08-18

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-08-12

Masterstudy Lms Learning Management System - Security Vulnerability (CVE-2026-28145)

Insufficient Verification of Data Authenticity vulnerability in StylemixThemes MasterStudy LMS allows Manipulating User State. This issue affects MasterStudy LMS: from n/a through 3.7.39.

PLUGIN Masterstudy Lms Learning Management System

CVE-2026-28145

MEDIUM CVSS 5.3 2026-07-31

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-07-30

Masterstudy Lms Learning Management System - Security Vulnerability (CVE-2026-5060)

The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.14. This is due to the `stm_lms_delete_cover()` function lacking ownership validation on the `file_id` parameter before passing it to `wp_delete_attachment()`. This makes it possible for authenticated attackers, with Instructor-level access and above, to delete arbitrary attachments belonging to any user by enumerating sequential attachment IDs.

PLUGIN Masterstudy Lms Learning Management System

CVE-2026-5060

MEDIUM CVSS 6.5 2026-07-29

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Masterstudy Lms Learning Management System - SQL Injection (CVE-2026-42730)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Blind SQL Injection.This issue affects MasterStudy LMS: from n/a through

PLUGIN Masterstudy Lms Learning Management System

CVE-2026-42730

HIGH CVSS 8.5 2026-05-27

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Masterstudy Lms Learning Management System - SQL Injection (CVE-2026-4817)

The MasterStudy LMS WordPress Plugin for Online Courses and Education plugin for WordPress is vulnerable to Time-based Blind SQL Injection via the 'order' and 'orderby' parameters in the /lms/stm-lms/order/items REST API endpoint in versions up to and including 3.7.25. This is due to insufficient input sanitization combined with a design flaw in the custom Query builder class that allows unquoted SQL injection in ORDER BY clauses. When the Query builder detects parentheses in the sort_by parameter, it treats the value as a SQL function and directly concatenates it into the…

PLUGIN Masterstudy Lms Learning Management System

CVE-2026-4817

MEDIUM CVSS 6.5 2026-04-17

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Masterstudy Lms Learning Management System - Cross-Site Scripting (XSS) (CVE-2026-0559)

The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'stm_lms_courses_grid_display' shortcode in all versions up to, and including, 3.7.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

PLUGIN Masterstudy Lms Learning Management System

CVE-2026-0559

MEDIUM CVSS 6.4 2026-02-14

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Masterstudy Lms Learning Management System - SQL Injection (CVE-2025-64366)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Blind SQL Injection.This issue affects MasterStudy LMS: from n/a through

PLUGIN Masterstudy Lms Learning Management System

CVE-2025-64366

HIGH CVSS 7.6 2025-10-31

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Masterstudy Lms Learning Management System - Information Disclosure (CVE-2025-59575)

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Retrieve Embedded Sensitive Data.This issue affects MasterStudy LMS: from n/a through

PLUGIN Masterstudy Lms Learning Management System

CVE-2025-59575

MEDIUM CVSS 4.9 2025-10-22

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Masterstudy Lms Learning Management System - Security Vulnerability (CVE-2025-59577)

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Leveraging Race Conditions.This issue affects MasterStudy LMS: from n/a through

PLUGIN Masterstudy Lms Learning Management System

CVE-2025-59577

MEDIUM CVSS 4.3 2025-09-22

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Masterstudy Lms Learning Management System - Broken Access Control (CVE-2025-59576)

Missing Authorization vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MasterStudy LMS: from n/a through

PLUGIN Masterstudy Lms Learning Management System

CVE-2025-59576

MEDIUM CVSS 6.5 2025-09-22

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Masterstudy Lms Learning Management System - Broken Access Control (CVE-2025-54744)

Missing Authorization vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MasterStudy LMS: from n/a through

PLUGIN Masterstudy Lms Learning Management System

CVE-2025-54744

MEDIUM CVSS 6.5 2025-09-05

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Masterstudy Lms Learning Management System - Broken Access Control (CVE-2025-32237)

Missing Authorization vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MasterStudy LMS: from n/a through

PLUGIN Masterstudy Lms Learning Management System

CVE-2025-32237

MEDIUM CVSS 4.3 2025-04-04

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Masterstudy Lms Learning Management System - Path Traversal (CVE-2025-32141)

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows PHP Local File Inclusion.This issue affects MasterStudy LMS: from n/a through

PLUGIN Masterstudy Lms Learning Management System

CVE-2025-32141

HIGH CVSS 8.8 2025-04-04

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Masterstudy Lms Learning Management System - Path Traversal (CVE-2024-3136)

The MasterStudy LMS plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.3 via the 'template' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

PLUGIN Masterstudy Lms Learning Management System

CVE-2024-3136

CRITICAL CVSS 9.8 2024-04-09

Risk Score

Open Full Technical Breakdown

Threat Database