EUVD-2026-64220

The Tutor LMS WordPress plugin before 4.0.6 does not validate a stored file path before using it to stream media, allowing users with the instructor role to read arbitrary files on the server, including files outside the web root. The readable files include the WordPress configuration file, which...

CVE-2026-19093

The Tutor LMS WordPress plugin before 4.0.6 does not validate a stored file path before using it to stream media. Users with the instructor role can exploit this to read arbitrary files on the server, including files outside the web root. Critically, the WordPress configuration file (wp-config.ph...

EUVD-2026-64215

The Tutor LMS WordPress plugin before 4.0.6 does not enforce per-object ownership checks on its course content type, allowing any user with the instructor role to read the content of private courses belonging to other instructors...

EUVD-2026-63367

ATutor is vulnerable to a Path Traversal vulnerability in ZIP extraction functionality. An attacker with instructor privileges can upload and extract a specially crafted ZIP archive, causing files to be written outside the intended extraction directory. This allows an attacker to place a...

CVE-2026-64966

ATutor (a learning management system) is affected by a Path Traversal vulnerability in its ZIP extraction functionality. An attacker with instructor privileges can upload a specially crafted ZIP archive that writes files outside the intended extraction directory, enabling placement of a server-ex...

CVE-2026-64966 Path Traversal leading to Remote Code Execution in ATutor

ATutor is vulnerable to a Path Traversal vulnerability in ZIP extraction functionality. An attacker with instructor privileges can upload and extract a specially crafted ZIP archive, causing files to be written outside the intended extraction directory. This allows an attacker to place a...

CVE-2026-64966 Path Traversal leading to Remote Code Execution in ATutor

ATutor is vulnerable to a Path Traversal vulnerability in ZIP extraction functionality. An attacker with instructor privileges can upload and extract a specially crafted ZIP archive, causing files to be written outside the intended extraction directory. This allows an attacker to place a...

CVE-2026-19712

The Masteriyo LMS WordPress plugin before 2.3.3 does not sanitise and escape a quiz field before outputting it back in a page, and grants its instructor role the ability to store unfiltered HTML, allowing such users to perform Stored Cross-Site Scripting attacks against any visitor of the affecte...

CVE-2026-19712 Masteriyo LMS < 2.3.3 - Instructor+ Stored XSS via Quiz Description

The Masteriyo LMS WordPress plugin before 2.3.3 does not sanitise and escape a quiz field before outputting it back in a page, and grants its instructor role the ability to store unfiltered HTML, allowing such users to perform Stored Cross-Site Scripting attacks against any visitor of the affecte...

CVE-2026-19712

The Masteriyo LMS WordPress plugin before 2.3.3 does not sanitise and escape a quiz field before outputting it back in a page, and grants its instructor role the ability to store unfiltered HTML, allowing such users to perform Stored Cross-Site Scripting attacks against any visitor of the affecte...

EUVD-2026-59915

The Masteriyo LMS WordPress plugin before 2.3.3 does not sanitise and escape a quiz field before outputting it back in a page, and grants its instructor role the ability to store unfiltered HTML, allowing such users to perform Stored Cross-Site Scripting attacks against any visitor of the affecte...

CVE-2026-19712

The Masteriyo LMS WordPress plugin (before 2.3.3) fails to sanitise a quiz field, and its instructor role can store unfiltered HTML, enabling stored XSS against any page visitor, including admins. CVSS 6.1 (MEDIUM). No exploit code is provided. Upgrade to 2.3.3 or set DISALLOW_UNFILTERED_HTML. Se...

CVE-2026-12971

The LearnPress WordPress plugin before 4.4.4 does not validate a user-supplied URL before the server fetches it, allowing users with the instructor role to induce the server to issue requests to arbitrary external hosts, a blind and bounded server-side request forgery...

CVE-2026-12971

The LearnPress WordPress plugin before 4.4.4 does not validate a user-supplied URL before the server fetches it, allowing users with the instructor role to induce the server to issue requests to arbitrary external hosts, a blind and bounded server-side request forgery...

EUVD-2026-55024

The LearnPress WordPress plugin before 4.4.4 does not validate a user-supplied URL before the server fetches it, allowing users with the instructor role to induce the server to issue requests to arbitrary external hosts, a blind and bounded server-side request forgery...

CVE-2026-12971 LearnPress < 4.4.4 - Instructor+ Server-Side Request Forgery via openai_apply_image_feature

The LearnPress WordPress plugin before 4.4.4 does not validate a user-supplied URL before the server fetches it, allowing users with the instructor role to induce the server to issue requests to arbitrary external hosts, a blind and bounded server-side request forgery...

CVE-2026-12971

The CVE refers to the LearnPress WordPress plugin before version 4.4.4. The issue is that the plugin does not validate a user-supplied URL before the server fetches it, enabling users with the instructor role to trigger the server to issue requests to arbitrary external hosts. This is described a...

WordPress LifterLMS plugin <= 10.0.9 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Mustafa Ahmed in WordPress Plugin LifterLMS versions = 10.0.9...

CVE-2026-14207

CVE-2026-14207 affects the LifterLMS WordPress plugin prior to 10.0.10. The root cause is that event-handler attributes in a course pricing field are not stripped before storage/rendering, allowing users with a course-editing role to inject JavaScript that executes in an administrator’s session w...

CVE-2026-5060

The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.14. This is due to the stmlmsdeletecover function lacking ownership validation on the fileid parameter before...