What’s Vulnerable › Products
MasterStudy LMS WordPress Plugin vulnerabilities
53 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 38 published in the last 12 months.
Check whether your MasterStudy LMS WordPress Plugin version is affected
Latest MasterStudy LMS WordPress Plugin vulnerabilities
- CVE-2026-88849 — MasterStudy LMS 3.7.13 - 3.7.54 - Instructor+ Arbitrary User Display Name Update via Student Enrollment (CVSS 2.7)
- CVE-2026-105079 — WordPress MasterStudy LMS plugin <= 3.7.52 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- CVE-2026-88847 — MasterStudy LMS < 3.7.50 - Subscriber+ Lesson Completion Record Creation (CVSS 4.3)
- CVE-2026-88846 — MasterStudy LMS 2.3.0 - < 3.7.50 - Unauthenticated Account Creation with Registration Disabled (CVSS 5.3)
- CVE-2026-88845 — MasterStudy LMS 2.3.0 - < 3.7.50 - Subscriber+ Course and Lesson Creation via Demo Import (CVSS 4.3)
- CVE-2026-88843 — MasterStudy LMS 3.5.29 - < 3.7.50 - Contributor+ LFI via Elementor Courses Categories Widget (CVSS 7.2)
- CVE-2026-81339 — MasterStudy LMS < 3.7.50 - Subscriber+ Quiz Attempt Grade Disclosure via IDOR (CVSS 4.3)
- CVE-2026-81338 — MasterStudy LMS < 3.7.50 - Subscriber+ Stored HTML Injection via Course Discussions (CVSS 4.6)
- CVE-2026-88844 — MasterStudy LMS 3.6.2 - < 3.7.50 - Instructor+ Student PII Disclosure via IDOR (CVSS 2.7)
- CVE-2026-81340 — MasterStudy LMS < 3.7.50 - Instructor+ Order Status Manipulation via IDOR (CVSS 3.8)
- CVE-2026-81199 — MasterStudy LMS < 3.7.46 - Unauthenticated Student Statistics Disclosure via student/stats REST Route (CVSS 5.3)
- CVE-2026-81198 — MasterStudy LMS < 3.7.46 - Instructor+ Cross-Course Curriculum Deletion and Tampering via IDOR (CVSS 3.8)
- CVE-2026-81197 — MasterStudy LMS < 3.7.46 - Unauthenticated Unpublished Course Title Disclosure via course-list REST Route (CVSS 5.3)
- CVE-2026-81196 — MasterStudy LMS < 3.7.46 - Instructor+ Quiz Answer Disclosure via IDOR (CVSS 2.7)
- CVE-2026-81195 — MasterStudy LMS < 3.7.46 - Unauthenticated Student Enrollment Disclosure via student-courses REST Route (CVSS 5.3)
- CVE-2026-81194 — MasterStudy LMS < 3.7.46 - Subscriber+ Cross-Instructor Order Data Disclosure via author_id Parameter (CVSS 4.3)
- CVE-2026-81342 — MasterStudy LMS < 3.7.43 - Unauthenticated Open Redirect (CVSS 4.7)
- CVE-2026-81200 — MasterStudy LMS < 3.7.42 - Instructor+ Cross-Tenant Order Billing PII Disclosure via IDOR (CVSS 2.7)
- CVE-2026-81026 — MasterStudy LMS < 3.7.40 - Unauthenticated Payment Bypass via PayPal IPN (CVSS 4.8)
- CVE-2026-78284 — WordPress MasterStudy LMS plugin <= 3.7.42 - Arbitrary File Deletion vulnerability (CVSS 8.6)
- CVE-2026-73404 — WordPress MasterStudy LMS plugin <= 3.7.41 - Broken Access Control vulnerability (CVSS 6.5)
- CVE-2026-68568 — WordPress MasterStudy LMS plugin <= 3.7.41 - Privilege Escalation vulnerability (CVSS 6.3)
- CVE-2026-28145 — WordPress MasterStudy LMS plugin <= 3.7.39 - Broken Access Control vulnerability (CVSS 5.3)
- CVE-2026-5060 — MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.14 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Attachment Deletion (CVSS 6.5)
- CVE-2026-57330 — WordPress MasterStudy LMS plugin <= 3.7.27 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)