26 matches found
CVE-2026-81198
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of a curriculum object before acting on it, allowing authenticated users with the instructor role to delete or modify curriculum sections and materials belonging to courses owned by other...
WordPress MasterStudy LMS WordPress Plugin plugin < 3.7.46 - Instructor+ Cross-Course Curriculum Deletion and Tampering vulnerability
Instructor+ Cross-Course Curriculum Deletion and Tampering vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin MasterStudy LMS versions 3.7.46...
CVE-2026-81198 MasterStudy LMS < 3.7.46 - Instructor+ Cross-Course Curriculum Deletion and Tampering via IDOR
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of a curriculum object before acting on it, allowing authenticated users with the instructor role to delete or modify curriculum sections and materials belonging to courses owned by other...
CVE-2026-81198
MasterStudy LMS WordPress plugin (versions before 3.7.46 ) contains an IDOR (Insecure Direct Object Reference) flaw: the plugin does not properly verify ownership of a curriculum object before acting on it. This allows authenticated users with the instructor role to delete or modify curriculum se...
CVE-2026-81200
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.42 does not correctly restrict access to order information, allowing any user with the instructor role to read other users' order billing details, including name, email address, phone number and postal address, by enumerating order...
CVE-2026-81200
CVE-2026-81200 affects the MasterStudy LMS WordPress plugin in versions before 3.7.42 . The flaw is an improper access restriction (IDOR) in the order information handling: any user holding the instructor role can enumerate order IDs to read other users' billing details—name, email address, phone...
EUVD-2026-64220
The Tutor LMS WordPress plugin before 4.0.6 does not validate a stored file path before using it to stream media, allowing users with the instructor role to read arbitrary files on the server, including files outside the web root. The readable files include the WordPress configuration file, which...
CVE-2026-19093
The Tutor LMS WordPress plugin before 4.0.6 does not validate a stored file path before using it to stream media. Users with the instructor role can exploit this to read arbitrary files on the server, including files outside the web root. Critically, the WordPress configuration file (wp-config.ph...
EUVD-2026-64215
The Tutor LMS WordPress plugin before 4.0.6 does not enforce per-object ownership checks on its course content type, allowing any user with the instructor role to read the content of private courses belonging to other instructors...
CVE-2026-19712
The Masteriyo LMS WordPress plugin before 2.3.3 does not sanitise and escape a quiz field before outputting it back in a page, and grants its instructor role the ability to store unfiltered HTML, allowing such users to perform Stored Cross-Site Scripting attacks against any visitor of the affecte...
CVE-2026-19712 Masteriyo LMS < 2.3.3 - Instructor+ Stored XSS via Quiz Description
The Masteriyo LMS WordPress plugin before 2.3.3 does not sanitise and escape a quiz field before outputting it back in a page, and grants its instructor role the ability to store unfiltered HTML, allowing such users to perform Stored Cross-Site Scripting attacks against any visitor of the affecte...
CVE-2026-19712
The Masteriyo LMS WordPress plugin before 2.3.3 does not sanitise and escape a quiz field before outputting it back in a page, and grants its instructor role the ability to store unfiltered HTML, allowing such users to perform Stored Cross-Site Scripting attacks against any visitor of the affecte...
EUVD-2026-59915
The Masteriyo LMS WordPress plugin before 2.3.3 does not sanitise and escape a quiz field before outputting it back in a page, and grants its instructor role the ability to store unfiltered HTML, allowing such users to perform Stored Cross-Site Scripting attacks against any visitor of the affecte...
CVE-2026-19712
The Masteriyo LMS WordPress plugin (before 2.3.3) fails to sanitise a quiz field, and its instructor role can store unfiltered HTML, enabling stored XSS against any page visitor, including admins. CVSS 6.1 (MEDIUM). No exploit code is provided. Upgrade to 2.3.3 or set DISALLOW_UNFILTERED_HTML. Se...
CVE-2026-12971
The LearnPress WordPress plugin before 4.4.4 does not validate a user-supplied URL before the server fetches it, allowing users with the instructor role to induce the server to issue requests to arbitrary external hosts, a blind and bounded server-side request forgery...
EUVD-2026-55024
The LearnPress WordPress plugin before 4.4.4 does not validate a user-supplied URL before the server fetches it, allowing users with the instructor role to induce the server to issue requests to arbitrary external hosts, a blind and bounded server-side request forgery...
CVE-2026-12971 LearnPress < 4.4.4 - Instructor+ Server-Side Request Forgery via openai_apply_image_feature
The LearnPress WordPress plugin before 4.4.4 does not validate a user-supplied URL before the server fetches it, allowing users with the instructor role to induce the server to issue requests to arbitrary external hosts, a blind and bounded server-side request forgery...
CVE-2026-12971
The CVE refers to the LearnPress WordPress plugin before version 4.4.4. The issue is that the plugin does not validate a user-supplied URL before the server fetches it, enabling users with the instructor role to trigger the server to issue requests to arbitrary external hosts. This is described a...
CVE-2026-14207
CVE-2026-14207 affects the LifterLMS WordPress plugin prior to 10.0.10. The root cause is that event-handler attributes in a course pricing field are not stripped before storage/rendering, allowing users with a course-editing role to inject JavaScript that executes in an administrator’s session w...