CVE-2026-80069 MasterStudy LMS WordPress Plugin < 3.7.50 Missing Authorization via stm_lms_send_test_email_ajax

MasterStudy LMS plugin for WordPress before 3.7.50 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to trigger the stmlmssendtestemailajax AJAX action without capability or nonce validation. Attackers can invoke this handler directly or via...

EUVD-2026-112859

MasterStudy LMS plugin for WordPress before 3.7.50 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to trigger the stmlmssendtestemailajax AJAX action without capability or nonce validation. Attackers can invoke this handler directly or via...

CVE-2026-80069

The MasterStudy LMS plugin for WordPress (versions before 3.7.50 ) is vulnerable to a missing authorization flaw. The stm_lms_send_test_email_ajax AJAX action lacks proper capability and nonce validation, allowing any authenticated user, including those with Subscriber roles, to trigger the actio...

CVE-2026-80069 MasterStudy LMS WordPress Plugin < 3.7.50 Missing Authorization via stm_lms_send_test_email_ajax

MasterStudy LMS plugin for WordPress before 3.7.50 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to trigger the stmlmssendtestemailajax AJAX action without capability or nonce validation. Attackers can invoke this handler directly or via...

CVE-2026-80067 MasterStudy LMS WordPress Plugin < 3.7.50 Path Traversal via stm_lms_step Parameter

MasterStudy LMS plugin for WordPress before 3.7.50 contains a path traversal vulnerability that allows authenticated Subscriber-level users to import arbitrary WXR XML files by supplying directory traversal sequences in the stmlmsstep parameter passed to the stmlmsimportsampledata AJAX action,...

CVE-2026-80067

The MasterStudy LMS plugin for WordPress versions before 3.7.50 is vulnerable to a path traversal vulnerability. The issue originates from the stm_lms_import_sample_data AJAX action, where the stm_lms_step parameter lacks sufficient capability checks and nonce verification. This allows authentica...

CVE-2026-80067 MasterStudy LMS WordPress Plugin < 3.7.50 Path Traversal via stm_lms_step Parameter

MasterStudy LMS plugin for WordPress before 3.7.50 contains a path traversal vulnerability that allows authenticated Subscriber-level users to import arbitrary WXR XML files by supplying directory traversal sequences in the stmlmsstep parameter passed to the stmlmsimportsampledata AJAX action,...

EUVD-2026-112926

MasterStudy LMS plugin for WordPress before 3.7.50 contains a path traversal vulnerability that allows authenticated Subscriber-level users to import arbitrary WXR XML files by supplying directory traversal sequences in the stmlmsstep parameter passed to the stmlmsimportsampledata AJAX action,...

WordPress JetEngine plugin <= 3.9.0.1 - SQL Injection vulnerability

SQL Injection vulnerability discovered by nh4tvd in WordPress Plugin JetEngine versions = 3.9.0.1...

WordPress SureForms plugin <= 2.12.9 - Content Injection vulnerability

Content Injection vulnerability discovered by Filip Kowalski in WordPress Plugin SureForms versions = 2.12.9...

WordPress Brave plugin <= 0.8.8 - Content Injection vulnerability

Content Injection vulnerability discovered by Peter Tang in WordPress Plugin Brave versions = 0.8.8...

WordPress Kali Forms plugin <= 2.4.27 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by nizar yart D3dC0d in WordPress Plugin Kali Forms versions = 2.4.27...

WordPress User Registration plugin <= 5.3.0 - Content Injection vulnerability

Content Injection vulnerability discovered by Filip Kowalski in WordPress Plugin User Registration versions = 5.3.0...

CVE-2026-116857 WordPress JetSmartFilters plugin <= 3.8.6.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Stored XSS.This issue affects JetSmartFilters: from n/a through 3.8.6.2...

WordPress JetSmartFilters plugin <= 3.8.6.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin JetSmartFilters versions = 3.8.6.2...

WordPress InstaWP Connect plugin <= 0.1.4.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by mroccon in WordPress Plugin InstaWP Connect versions = 0.1.4.2...

WordPress Import and export users and customers plugin <= 2.5.9 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dzaku in WordPress Plugin Import and export users and customers versions = 2.5.9...

CVE-2026-48195 WordPress PDF Poster plugin <= 2.6.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in bPlugins PDF Poster pdf-poster allows Stored XSS.This issue affects PDF Poster: from n/a through 2.6.1...

WordPress PDF Poster plugin <= 2.6.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by mroccon in WordPress Plugin PDF Poster versions = 2.6.1...

WordPress Simple Cloudflare Turnstile plugin <= 1.44.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by mroccon in WordPress Plugin Simple Cloudflare Turnstile versions = 1.44.0...