MasterStudy LMS < 3.7.46 - Unauthenticated Student Statistics Disclosure

MasterStudy LMS WordPress plugin before 3.7.46 contains an information disclosure vulnerability caused by missing authorization checks in student learning statistics, letting unauthenticated attackers access sensitive user course data, exploit requires no authentication. id: CVE-2026-81199 info:...

MasterStudy LMS WordPress Plugin <= 3.2.5 - SQL Injection

The MasterStudy LMS WordPress Plugin for Online Courses and Education plugin for WordPress is vulnerable to union based SQL Injection via the 'user' parameter of the /lms/stm-lms/order/items REST route in all versions up to, and including, 3.2.5 due to insufficient escaping on the user supplied...

CVE-2022-0441

A vulnerability classified as critical was found in MasterStudy LMS Plugin up to 2.7.5 on WordPress WordPress Plugin. This vulnerability affects an unknown part of the component New Account Handler. The manipulation with an unknown input leads to a privileges management vulnerability. The CWE...

CVE-2022-0441

CVE-2022-0441 Title: WordPress Plugin MasterStudy LMS 2.7.5 - Unauthenticated Admin Account Creation Date: 16.02.2022 Author: Numan Türle CVE: CVE-2022-0441 Software Link: https://wordpress.org/plugins/masterstudy-lms-learning-management-system/ Version: 2.7.6 Installation git clone...

CVE-2026-105079

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-management-system allows Stored XSS.This issue affects MasterStudy LMS: from n/a through 3.7.52...

EUVD-2026-94952

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-management-system allows Stored XSS.This issue affects MasterStudy LMS: from n/a through 3.7.52...

CVE-2026-105079

The MasterStudy LMS (masterstudy-lms-learning-management-system) plugin by StylemixThemes is vulnerable to Stored Cross-site Scripting (XSS) due to improper neutralization of input during web page generation. This vulnerability affects versions from n/a through 3.7.52 . An attacker could potentia...

CVE-2026-105079 WordPress MasterStudy LMS plugin <= 3.7.52 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-management-system allows Stored XSS.This issue affects MasterStudy LMS: from n/a through 3.7.52...

WordPress MasterStudy LMS plugin <= 3.7.52 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Deva Parekh in WordPress Plugin MasterStudy LMS versions = 3.7.52...

CVE-2024-1512

CVE-2024-1512 Proof of Concept Vulnerability Overview CVE-2024-1512 exposes a critical vulnerability in the MasterStudy LMS WordPress Plugin, specifically within the implementation of the /lms/stm-lms/order/items REST route. The issue arises from the plugin's failure to properly escape the 'user'...

CVE-2022-0441

MasterStudy LMS 플러그인 2.7.5까지의 WordPressWordPress 플러그인에서 중요도가 높은 취약점이 발견되었습니다. 이 취약점은 New Account Handler 구성 요소의 알 수 없는 부분에 영향을 미칩니다. 알 수 없는 입력을 통한 조작으로 권한 관리 취약점이 발생합니다. 이 취약점에 대한 CWE 정의는 CWE-269입니다. 이 소프트웨어는 액터에 대한 권한을 올바르게 할당, 수정, 추적 또는 확인하지 않아 해당 액터에게 의도하지 않은 통제 범위를 생성합니다. 영향으로는 기밀성, 무결성 및 가용성...

CVE-2023-4278

CVE-2023-4278 Exploit Title: Wordpress Plugin Masterstudy LMS = 3.0.17 - Unauthenticated Instructor Account Creation Google Dork: inurl:/user-public-account Vendor Homepage: https://wordpress.org/plugins/masterstudy-lms-learning-management-system/ Software Link: https://stylemixthemes.com Version...

CVE-2026-88848

The MasterStudy LMS WordPress plugin from 1.9 before 3.7.50 does not verify that a course a member asks to enrol in is covered by their membership plan, nor that the plan identifier submitted with the request is one they actually hold, allowing any member to enrol themselves into restricted paid...

CVE-2026-88848 MasterStudy LMS 1.9 - < 3.7.50 - Subscriber+ Membership Plan Quota and Category Restriction Bypass

The MasterStudy LMS WordPress plugin from 1.9 before 3.7.50 does not verify that a course a member asks to enrol in is covered by their membership plan, nor that the plan identifier submitted with the request is one they actually hold, allowing any member to enrol themselves into restricted paid...

WordPress MasterStudy LMS plugin < 3.7.50 - Subscriber+ Membership Plan Quota and Category Restriction Bypass vulnerability

Subscriber+ Membership Plan Quota and Category Restriction Bypass vulnerability discovered by Arman Kumar in WordPress Plugin MasterStudy LMS versions 3.7.50...

CVE-2026-88848 MasterStudy LMS 1.9 - < 3.7.50 - Subscriber+ Membership Plan Quota and Category Restriction Bypass

The MasterStudy LMS WordPress plugin from 1.9 before 3.7.50 does not verify that a course a member asks to enrol in is covered by their membership plan, nor that the plan identifier submitted with the request is one they actually hold, allowing any member to enrol themselves into restricted paid...

CVE-2026-88848

The MasterStudy LMS WordPress plugin (versions 1.9 to

EUVD-2026-86627

The MasterStudy LMS WordPress plugin from 1.9 before 3.7.50 does not verify that a course a member asks to enrol in is covered by their membership plan, nor that the plan identifier submitted with the request is one they actually hold, allowing any member to enrol themselves into restricted paid...

WordPress MasterStudy LMS WordPress Plugin plugin 2.3.0-3.7.49 - Unauthenticated Account Creation with Registration Disabled vulnerability

Unauthenticated Account Creation with Registration Disabled vulnerability discovered by vuxvinh in WordPress Plugin MasterStudy LMS versions 2.3.0-3.7.49...

CVE-2026-88848: Incorrect Authorization

The MasterStudy LMS WordPress plugin from 1.9 before 3.7.50 does not verify that a course a member asks to enrol in is covered by their membership plan, nor that the plan identifier submitted with the request is one they actually hold, allowing any member to enrol themselves into restricted paid...