PT-2026-77121

Subscriber Broken Access Control in MasterStudy LMS = 3.7.41 versions...

PT-2026-77079

Subscriber Privilege Escalation in MasterStudy LMS = 3.7.41 versions...

CVE-2026-28145: Insufficient Verification of Data Authenticity

Insufficient Verification of Data Authenticity vulnerability in StylemixThemes MasterStudy LMS allows Manipulating User State. This issue affects MasterStudy LMS: from n/a through 3.7.39...

CVE-2026-5060 MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.14 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Attachment Deletion

The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.14. This is due to the stmlmsdeletecover function lacking ownership validation on the fileid parameter before...

PT-2026-65775

The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.14. This is due to the stm lms delete cover function lacking ownership validation on the file id parameter befor...

CVE-2026-5060: Authorization Bypass Through User-Controlled Key

The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.14. This is due to the stmlmsdeletecover function lacking ownership validation on the fileid parameter before...

WordPress MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin <= 3.7.23 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Attachment Deletion vulnerability

Insecure Direct Object Reference to Authenticated Instructor+ Arbitrary Attachment Deletion vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan in WordPress Plugin MasterStudy LMS versions = 3.7.23...

Exploit for Improper Privilege Management in Stylemixthemes Masterstudy_Lms

!imagehttps://github.com/tegal1337/CVE-2022-0441/assets/31664...

CVE-2026-57330

Subscriber Cross Site Scripting XSS in MasterStudy LMS = 3.7.27 versions...

CVE-2026-57330 WordPress MasterStudy LMS plugin <= 3.7.27 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in MasterStudy LMS = 3.7.27 versions...

CVE-2026-57330

Subscriber Cross Site Scripting XSS in MasterStudy LMS = 3.7.27 versions...

EUVD-2026-40101

Subscriber Cross Site Scripting XSS in MasterStudy LMS = 3.7.27 versions...

CVE-2026-57330 WordPress MasterStudy LMS plugin <= 3.7.27 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in MasterStudy LMS = 3.7.27 versions...

WordPress MasterStudy LMS plugin <= 3.7.27 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by endy in WordPress Plugin MasterStudy LMS versions = 3.7.27...

CVE-2026-57330: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in MasterStudy LMS = 3.7.27 versions...

CVE-2026-57640

Subscriber Broken Access Control in MasterStudy LMS = 3.7.30 versions...

CVE-2026-57640

CVE-2026-57640 : A Broken Access Control vulnerability affects the WordPress plugin MasterStudy LMS up to version 3.7.30 . The issue is documented with a CVSS 3.1 base score of 4.3 (Medium) and describes restricted access conditions that could permit unauthorized exposure of resources. The availa...

CVE-2026-57640 WordPress MasterStudy LMS plugin <= 3.7.30 - Broken Access Control vulnerability

Subscriber Broken Access Control in MasterStudy LMS = 3.7.30 versions...

CVE-2026-57640 WordPress MasterStudy LMS plugin <= 3.7.30 - Broken Access Control vulnerability

Subscriber Broken Access Control in MasterStudy LMS = 3.7.30 versions...

CVE-2026-57640

Subscriber Broken Access Control in MasterStudy LMS = 3.7.30 versions...