12 matches found
Automattic Sensei LMS Authorization Issue Vulnerability
Automattic Sensei LMS versions prior to 4.26.4 have an authorization issue vulnerability. This vulnerability stems from the old savenewmessage processing routine, which relies on the init action hook. This routine only verifies a generic nonce; it does not verify course registration or limit post...
Automattic Sensei LMS Authorization Issue Vulnerability
Automattic Sensei LMS versions prior to 4.26.4 have an authorization issue vulnerability. This vulnerability stems from improper access control in the AJAX handler for addnewmoduleterm. Only a generic nonce is verified, and only checks are performed for slug prefixes in manageoptions, without...
EUVD-2023-55608
Malicious code in bioql PyPI...
CVE-2023-50875
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Automattic Sensei LMS – Online Courses, Quizzes, & Learning allows Stored XSS.This issue affects Sensei LMS – Online Courses, Quizzes, & Learning: from n/a through 4.17.0...
CVE-2025-22740
Missing Authorization vulnerability in Automattic Sensei LMS sensei-lms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sensei LMS: from n/a through = 4.24.4...
CVE-2025-22740
CVE-2025-22740 (Sensei LMS) is a Missing Authorization vulnerability affecting Sensei LMS versions up to 4.24.4. Public details indicate an authorization gap that could allow access to restricted actions/resources. The vulnerability is listed as patched by Wordfence (patched status) and the CVSS ...
PT-2025-13397
Name of the Vulnerable Software and Affected Versions Automattic Sensei LMS versions 4.24.4 and earlier Description The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations For Automattic Sensei L...
CVE-2024-35686: Missing Authorization
Missing Authorization vulnerability in Automattic Sensei LMS, Automattic Sensei Pro WC Paid Courses.This issue affects Sensei LMS: from n/a through 4.23.1; Sensei Pro WC Paid Courses: from n/a through 4.23.1.1.23.1...
PT-2024-26634 · Automattic · Automattic Sensei Pro +1
Name of the Vulnerable Software and Affected Versions: Automattic Sensei LMS versions 4.23.1 and earlier Automattic Sensei Pro WC Paid Courses versions 4.23.1 and earlier Description: The issue is related to a Missing Authorization vulnerability in Automattic Sensei LMS and Automattic Sensei Pro ...
CVE-2023-50875
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Automattic Sensei LMS – Online Courses, Quizzes, & Learning allows Stored XSS.This issue affects Sensei LMS – Online Courses, Quizzes, & Learning: from n/a through 4.17.0...
CVE-2023-50875 WordPress Sensei LMS Plugin <= 4.17.0 is vulnerable to Cross Site Scripting (XSS)
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Automattic Sensei LMS – Online Courses, Quizzes, & Learning allows Stored XSS.This issue affects Sensei LMS – Online Courses, Quizzes, & Learning: from n/a through 4.17.0...