EUVD-2026-65159

Unauthenticated Arbitrary File Deletion in MasterStudy LMS = 3.7.42 versions...

CVE-2026-78284

CVE-2026-78284 is an unauthenticated arbitrary file deletion vulnerability in the MasterStudy LMS WordPress plugin, affecting versions 3.7.42 and earlier . An attacker can delete files on the server without any authentication or user interaction. The CVSS 3.1 base score is 8.6 (HIGH) , driven by ...

MasterStudy LMS WordPress Plugin <= 3.2.5 - SQL Injection

The MasterStudy LMS WordPress Plugin for Online Courses and Education plugin for WordPress is vulnerable to union based SQL Injection via the 'user' parameter of the /lms/stm-lms/order/items REST route in all versions up to, and including, 3.2.5 due to insufficient escaping on the user supplied...

CVE-2026-73404

Subscriber Broken Access Control in MasterStudy LMS = 3.7.41 versions...

CVE-2026-68568

Subscriber Privilege Escalation in MasterStudy LMS = 3.7.41 versions...

EUVD-2026-60807

Subscriber Broken Access Control in MasterStudy LMS = 3.7.41 versions...

CVE-2026-73404

Subscriber users of MasterStudy LMS plugin

CVE-2026-73404 WordPress MasterStudy LMS plugin <= 3.7.41 - Broken Access Control vulnerability

Subscriber Broken Access Control in MasterStudy LMS = 3.7.41 versions...

CVE-2026-73404

Subscriber Broken Access Control in MasterStudy LMS = 3.7.41 versions...

CVE-2026-68568

Subscriber Privilege Escalation in MasterStudy LMS = 3.7.41 versions...

EUVD-2026-60936

Subscriber Privilege Escalation in MasterStudy LMS = 3.7.41 versions...

CVE-2026-68568 WordPress MasterStudy LMS plugin <= 3.7.41 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in MasterStudy LMS = 3.7.41 versions...

CVE-2026-68568

WordPress MasterStudy LMS plugin (≤ 3.7.41) allows authenticated subscribers to escalate privileges, likely by bypassing capability checks in REST endpoints or AJAX handlers. CVSS 6.3 (medium) — network attack, low privileges required. No in-the-wild exploitation reported. Upgrade to a patched ve...

CVE-2026-5060 MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.14 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Attachment Deletion

The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.14. This is due to the stmlmsdeletecover function lacking ownership validation on the fileid parameter before...

CVE-2026-57330

Subscriber Cross Site Scripting XSS in MasterStudy LMS = 3.7.27 versions...

CVE-2026-57330

Subscriber Cross Site Scripting XSS in MasterStudy LMS = 3.7.27 versions...

EUVD-2026-40101

Subscriber Cross Site Scripting XSS in MasterStudy LMS = 3.7.27 versions...

CVE-2026-57330 WordPress MasterStudy LMS plugin <= 3.7.27 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in MasterStudy LMS = 3.7.27 versions...

CVE-2026-57640

Subscriber Broken Access Control in MasterStudy LMS = 3.7.30 versions...

CVE-2026-57640

CVE-2026-57640 : A Broken Access Control vulnerability affects the WordPress plugin MasterStudy LMS up to version 3.7.30 . The issue is documented with a CVSS 3.1 base score of 4.3 (Medium) and describes restricted access conditions that could permit unauthorized exposure of resources. The availa...