MasterStudy LMS < 3.7.46 - Unauthenticated Student Statistics Disclosure

MasterStudy LMS WordPress plugin before 3.7.46 contains an information disclosure vulnerability caused by missing authorization checks in student learning statistics, letting unauthenticated attackers access sensitive user course data, exploit requires no authentication. id: CVE-2026-81199 info:...

CVE-2024-1512

CVE-2024-1512 Proof of Concept Vulnerability Overview CVE-2024-1512 exposes a critical vulnerability in the MasterStudy LMS WordPress Plugin, specifically within the implementation of the /lms/stm-lms/order/items REST route. The issue arises from the plugin's failure to properly escape the 'user'...

CVE-2022-0441

CVE-2022-0441 Title: WordPress Plugin MasterStudy LMS 2.7.5 - Unauthenticated Admin Account Creation Date: 16.02.2022 Author: Numan Türle CVE: CVE-2022-0441 Software Link: https://wordpress.org/plugins/masterstudy-lms-learning-management-system/ Version: 2.7.6 Installation git clone...

CVE-2023-4278

CVE-2023-4278 Exploit Title: Wordpress Plugin Masterstudy LMS = 3.0.17 - Unauthenticated Instructor Account Creation Google Dork: inurl:/user-public-account Vendor Homepage: https://wordpress.org/plugins/masterstudy-lms-learning-management-system/ Software Link: https://stylemixthemes.com Version...

CVE-2022-0441

A vulnerability classified as critical was found in MasterStudy LMS Plugin up to 2.7.5 on WordPress WordPress Plugin. This vulnerability affects an unknown part of the component New Account Handler. The manipulation with an unknown input leads to a privileges management vulnerability. The CWE...

MasterStudy LMS WordPress Plugin <= 3.2.5 - SQL Injection

The MasterStudy LMS WordPress Plugin for Online Courses and Education plugin for WordPress is vulnerable to union based SQL Injection via the 'user' parameter of the /lms/stm-lms/order/items REST route in all versions up to, and including, 3.2.5 due to insufficient escaping on the user supplied...

CVE-2022-0441

A vulnerability classified as critical was found in MasterStudy LMS Plugin up to 2.7.5 on WordPress WordPress Plugin. This vulnerability affects an unknown part of the component New Account Handler. The manipulation with an unknown input leads to a privileges management vulnerability. The CWE...

CVE-2026-119478

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-management-system allows Code Injection.This issue affects MasterStudy LMS: from n/a through 3.7.56...

CVE-2026-119478 WordPress MasterStudy LMS plugin <= 3.7.56 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-management-system allows Code Injection.This issue affects MasterStudy LMS: from n/a through 3.7.56...

CVE-2026-119478

The MasterStudy LMS plugin for WordPress (versions through 3.7.56 ) is vulnerable to a Content Injection (Basic XSS) vulnerability. This issue is caused by Improper Neutralization of Script-Related HTML Tags in a web page, allowing for Code Injection . While the vulnerability is documented, speci...

EUVD-2026-119092

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-management-system allows Code Injection.This issue affects MasterStudy LMS: from n/a through 3.7.56...

WordPress MasterStudy LMS plugin <= 3.7.56 - Content Injection vulnerability

Content Injection vulnerability discovered by mroccon in WordPress Plugin MasterStudy LMS versions = 3.7.56...

CVE-2026-118090

Subscriber PHP Object Injection in MasterStudy LMS = 3.7.55 versions...

EUVD-2026-114316

Subscriber PHP Object Injection in MasterStudy LMS = 3.7.55 versions...

CVE-2026-118090 WordPress MasterStudy LMS plugin <= 3.7.55 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in MasterStudy LMS = 3.7.55 versions...

CVE-2026-118090

The MasterStudy LMS WordPress plugin (versions

CVE-2026-118090 WordPress MasterStudy LMS plugin <= 3.7.55 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in MasterStudy LMS = 3.7.55 versions...

WordPress MasterStudy LMS plugin <= 3.7.55 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Siyang Wu in WordPress Plugin MasterStudy LMS versions = 3.7.55...

CVE-2026-118090: Stylemix MasterStudy LMS: Subscriber PHP Object Injection in MasterStudy LMS <= 3.7.55 versions.

Subscriber PHP Object Injection in MasterStudy LMS = 3.7.55 versions...

PT-2026-133766

Name of the Vulnerable Software and Affected Versions MasterStudy LMS versions prior to 3.7.56 Description An issue exists that allows for PHP Object Injection, a technique where an attacker can manipulate serialized objects to execute arbitrary code or interfere with application logic...