CVE-2026-81338 MasterStudy LMS < 3.7.50 - Subscriber+ Stored HTML Injection via Course Discussions

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not properly sanitise and restrict HTML in user-submitted content before storing it and rendering it to other users, allowing users with subscriber-level accounts and above to perform stored HTML injection, such as embedding...

WordPress MasterStudy LMS WordPress Plugin plugin < 3.7.50 - Subscriber+ Stored HTML Injection vulnerability

Subscriber+ Stored HTML Injection vulnerability discovered by Jaime F. Murillo in WordPress Plugin MasterStudy LMS versions 3.7.50...

WordPress MasterStudy LMS WordPress Plugin plugin < 3.7.50 - Subscriber+ Quiz Attempt Grade Disclosure vulnerability

Subscriber+ Quiz Attempt Grade Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin MasterStudy LMS versions 3.7.50...

CVE-2026-81339 MasterStudy LMS < 3.7.50 - Subscriber+ Quiz Attempt Grade Disclosure via IDOR

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform a per-object ownership check when returning a quiz attempt result, allowing any authenticated user with a minimal subscriber role to read other students' quiz grades, pass/fail status and attempt timestamps by...

CVE-2026-81339: Authorization Bypass Through User-Controlled Key

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform a per-object ownership check when returning a quiz attempt result, allowing any authenticated user with a minimal subscriber role to read other students' quiz grades, pass/fail status and attempt timestamps by...

PT-2026-97164

Name of the Vulnerable Software and Affected Versions MasterStudy LMS WordPress Plugin versions prior to 3.7.50 Description Insufficient sanitization and restriction of HTML in user-submitted content allows users with subscriber-level accounts and above to perform stored HTML injection. This issu...

PT-2026-97165

Name of the Vulnerable Software and Affected Versions MasterStudy LMS WordPress Plugin versions prior to 3.7.50 Description An issue exists where the plugin fails to perform a per-object ownership check when returning quiz attempt results. This allows any authenticated user with a subscriber role...

CVE-2026-81338: Insufficient Verification of Data Authenticity

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not properly sanitise and restrict HTML in user-submitted content before storing it and rendering it to other users, allowing users with subscriber-level accounts and above to perform stored HTML injection, such as embedding...

CVE-2026-88844

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that the requesting user owns the course before returning its enrolled-student data, allowing users with the MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50's Instructor role to disclose the names...

CVE-2026-81340

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating orders through its REST API, allowing users with the Instructor role to modify any order on the site, granting free course enrolment, revoking other users'...

CVE-2026-88844 MasterStudy LMS 3.6.2 - < 3.7.50 - Instructor+ Student PII Disclosure via IDOR

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that the requesting user owns the course before returning its enrolled-student data, allowing users with the MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50's Instructor role to disclose the names...

CVE-2026-88844

The MasterStudy LMS WordPress Plugin for WordPress (versions 3.6.2 to 3.7.49 ) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The plugin fails to verify if a requesting user owns a specific course before returning its enrolled-student data. This allows users with the Instructor...

CVE-2026-88844 MasterStudy LMS 3.6.2 - < 3.7.50 - Instructor+ Student PII Disclosure via IDOR

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that the requesting user owns the course before returning its enrolled-student data, allowing users with the MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50's Instructor role to disclose the names...

EUVD-2026-82678

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that the requesting user owns the course before returning its enrolled-student data, allowing users with the MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50's Instructor role to disclose the names...

WordPress MasterStudy LMS WordPress Plugin plugin 3.6.2-3.7.49 - Instructor+ Student PII Disclosure vulnerability

Instructor+ Student PII Disclosure vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin MasterStudy LMS versions 3.6.2-3.7.49...

WordPress MasterStudy LMS WordPress Plugin plugin < 3.7.50 - Instructor+ Order Status Manipulation vulnerability

Instructor+ Order Status Manipulation vulnerability discovered by Shivamani Vastrala in WordPress Plugin MasterStudy LMS versions 3.7.50...

EUVD-2026-82658

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating orders through its REST API, allowing users with the Instructor role to modify any order on the site, granting free course enrolment, revoking other users'...

CVE-2026-81340

The MasterStudy LMS WordPress Plugin (versions prior to 3.7.50 ) contains an authorization bypass vulnerability due to a lack of per-object ownership or capability checks when updating orders via its REST API . This allows authenticated users with the Instructor role to manipulate any order on th...

CVE-2026-81340 MasterStudy LMS < 3.7.50 - Instructor+ Order Status Manipulation via IDOR

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating orders through its REST API, allowing users with the Instructor role to modify any order on the site, granting free course enrolment, revoking other users'...

CVE-2026-81340 MasterStudy LMS < 3.7.50 - Instructor+ Order Status Manipulation via IDOR

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating orders through its REST API, allowing users with the Instructor role to modify any order on the site, granting free course enrolment, revoking other users'...