WordPress Taxi Booking Manager for WooCommerce plugin <= 2.1.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Peter Tang in WordPress Plugin Taxi Booking Manager for WooCommerce versions = 2.1.6...

WordPress Happy Addons for Elementor plugin <= 3.50.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ayukiab in WordPress Plugin Happy Addons for Elementor versions = 3.50.1...

WordPress User Registration plugin <= 5.3.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by elba.code in WordPress Plugin User Registration versions = 5.3.0...

WordPress Media LIbrary Assistant plugin <= 3.42 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Deva Parekh in WordPress Plugin Media LIbrary Assistant versions = 3.42...

WordPress WPFunnels plugin <= 3.13.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Matthew Lapinski in WordPress Plugin WPFunnels versions = 3.13.5...

WordPress SureDash plugin <= 1.12.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by yzx001 in WordPress Plugin SureDash versions = 1.12.3...

WordPress SureDash plugin <= 1.12.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by yzx001 in WordPress Plugin SureDash versions = 1.12.3...

WordPress StreamCast plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by V1T in WordPress Plugin StreamCast versions = 2.4.6...

WordPress JetElements For Elementor plugin <= 2.9.2.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin JetElements For Elementor versions = 2.9.2.6...

WordPress WPFunnels plugin <= 3.13.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Je22y in WordPress Plugin WPFunnels versions = 3.13.5...

WordPress SureForms plugin <= 2.12.9 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Luke Schneider in WordPress Plugin SureForms versions = 2.12.9...

WordPress Webba Booking plugin <= 6.5.4 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by HAIMIN in WordPress Plugin Webba Booking versions = 6.5.4...

CVE-2026-80069 MasterStudy LMS WordPress Plugin < 3.7.50 Missing Authorization via stm_lms_send_test_email_ajax

MasterStudy LMS plugin for WordPress before 3.7.50 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to trigger the stmlmssendtestemailajax AJAX action without capability or nonce validation. Attackers can invoke this handler directly or via...

CVE-2026-80069 MasterStudy LMS WordPress Plugin < 3.7.50 Missing Authorization via stm_lms_send_test_email_ajax

MasterStudy LMS plugin for WordPress before 3.7.50 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to trigger the stmlmssendtestemailajax AJAX action without capability or nonce validation. Attackers can invoke this handler directly or via...

CVE-2026-80069

The MasterStudy LMS plugin for WordPress (versions before 3.7.50 ) is vulnerable to a missing authorization flaw. The stm_lms_send_test_email_ajax AJAX action lacks proper capability and nonce validation, allowing any authenticated user, including those with Subscriber roles, to trigger the actio...

EUVD-2026-112859

MasterStudy LMS plugin for WordPress before 3.7.50 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to trigger the stmlmssendtestemailajax AJAX action without capability or nonce validation. Attackers can invoke this handler directly or via...

CVE-2026-80067 MasterStudy LMS WordPress Plugin < 3.7.50 Path Traversal via stm_lms_step Parameter

MasterStudy LMS plugin for WordPress before 3.7.50 contains a path traversal vulnerability that allows authenticated Subscriber-level users to import arbitrary WXR XML files by supplying directory traversal sequences in the stmlmsstep parameter passed to the stmlmsimportsampledata AJAX action,...

CVE-2026-80067 MasterStudy LMS WordPress Plugin < 3.7.50 Path Traversal via stm_lms_step Parameter

MasterStudy LMS plugin for WordPress before 3.7.50 contains a path traversal vulnerability that allows authenticated Subscriber-level users to import arbitrary WXR XML files by supplying directory traversal sequences in the stmlmsstep parameter passed to the stmlmsimportsampledata AJAX action,...

CVE-2026-80067

The MasterStudy LMS plugin for WordPress versions before 3.7.50 is vulnerable to a path traversal vulnerability. The issue originates from the stm_lms_import_sample_data AJAX action, where the stm_lms_step parameter lacks sufficient capability checks and nonce verification. This allows authentica...

EUVD-2026-112926

MasterStudy LMS plugin for WordPress before 3.7.50 contains a path traversal vulnerability that allows authenticated Subscriber-level users to import arbitrary WXR XML files by supplying directory traversal sequences in the stmlmsstep parameter passed to the stmlmsimportsampledata AJAX action,...