Masterstudy Lms Wordpress Plugin

WordPress plugin · masterstudy-lms-wordpress-plugin · WordPress.org ↗

Critical

High

Known total

Unfixed

Running Masterstudy Lms Wordpress Plugin on your site? WP Alerts checks your installed version against every entry below and emails you only when one affects you. Free, no tracking.

Scan a site Monitor my sites →

Severity	Vulnerability	Affected	Fixed in	CVE	Published
HIGH CVSS 7.2	MasterStudy LMS 3.5.29 - < 3.7.50 - Contributor+ LFI via Elementor Courses Categories Widget CVE.org	>=3.5.29, <3.7.50	v3.7.50	CVE-2026-88843	Sep 24, 2026
MEDIUM CVSS 5.3	MasterStudy LMS WordPress Plugin < 3.7.50 Missing Authorization via stm_lms_send_test_email_ajax CVE.org	>=0, <3.7.50	v3.7.50	CVE-2026-80069	Oct 29, 2026
MEDIUM CVSS 5.3	MasterStudy LMS WordPress Plugin < 3.7.50 Path Traversal via stm_lms_step Parameter CVE.org	>=0, <3.7.50	v3.7.50	CVE-2026-80067	Oct 29, 2026
MEDIUM CVSS 4.3	MasterStudy LMS < 3.7.50 - Subscriber+ Lesson Completion Record Creation CVE.org	>=0, <3.7.50	v3.7.50	CVE-2026-88847	Sep 24, 2026
MEDIUM CVSS 5.3	MasterStudy LMS 2.3.0 - < 3.7.50 - Unauthenticated Account Creation with Registration Disabled CVE.org	>=2.3.0, <3.7.50	v3.7.50	CVE-2026-88846	Sep 24, 2026
MEDIUM CVSS 4.3	MasterStudy LMS 2.3.0 - < 3.7.50 - Subscriber+ Course and Lesson Creation via Demo Import CVE.org	>=2.3.0, <3.7.50	v3.7.50	CVE-2026-88845	Sep 24, 2026
MEDIUM CVSS 4.3	MasterStudy LMS < 3.7.50 - Subscriber+ Quiz Attempt Grade Disclosure via IDOR CVE.org	>=0, <3.7.50	v3.7.50	CVE-2026-81339	Sep 23, 2026
MEDIUM CVSS 4.6	MasterStudy LMS < 3.7.50 - Subscriber+ Stored HTML Injection via Course Discussions CVE.org	>=0, <3.7.50	v3.7.50	CVE-2026-81338	Sep 23, 2026
MEDIUM CVSS 5.3	MasterStudy LMS < 3.7.46 - Unauthenticated Student Statistics Disclosure via student/stats REST Route CVE.org	>=0, <3.7.46	v3.7.46	CVE-2026-81199	Sep 2, 2026
MEDIUM CVSS 5.3	MasterStudy LMS < 3.7.46 - Unauthenticated Unpublished Course Title Disclosure via course-list REST Route CVE.org	>=0, <3.7.46	v3.7.46	CVE-2026-81197	Sep 2, 2026
MEDIUM CVSS 5.3	MasterStudy LMS < 3.7.46 - Unauthenticated Student Enrollment Disclosure via student-courses REST Route CVE.org	>=0, <3.7.46	v3.7.46	CVE-2026-81195	Sep 2, 2026
MEDIUM CVSS 4.3	MasterStudy LMS < 3.7.46 - Subscriber+ Cross-Instructor Order Data Disclosure via author_id Parameter CVE.org	>=0, <3.7.46	v3.7.46	CVE-2026-81194	Sep 2, 2026
MEDIUM CVSS 4.8	MasterStudy LMS < 3.7.40 - Unauthenticated Payment Bypass via PayPal IPN CVE.org	>=0, <3.7.40	v3.7.40	CVE-2026-81026	Aug 29, 2026
MEDIUM CVSS 4.7	MasterStudy LMS < 3.7.43 - Unauthenticated Open Redirect CVE.org	>=0, <3.7.43	v3.7.43	CVE-2026-81342	Aug 29, 2026
LOW CVSS 2.7	MasterStudy LMS 3.7.13 - 3.7.54 - Instructor+ Arbitrary User Display Name Update via Student Enrollment CVE.org	>=3.7.13, <3.7.55	v3.7.55	CVE-2026-88849	Oct 22, 2026
LOW CVSS 2.7	MasterStudy LMS 3.6.2 - < 3.7.50 - Instructor+ Student PII Disclosure via IDOR CVE.org	>=3.6.2, <3.7.50	v3.7.50	CVE-2026-88844	Sep 18, 2026
LOW CVSS 3.8	MasterStudy LMS < 3.7.50 - Instructor+ Order Status Manipulation via IDOR CVE.org	>=0, <3.7.50	v3.7.50	CVE-2026-81340	Sep 18, 2026
LOW CVSS 3.8	MasterStudy LMS < 3.7.46 - Instructor+ Cross-Course Curriculum Deletion and Tampering via IDOR CVE.org	>=0, <3.7.46	v3.7.46	CVE-2026-81198	Sep 2, 2026
LOW CVSS 2.7	MasterStudy LMS < 3.7.46 - Instructor+ Quiz Answer Disclosure via IDOR CVE.org	>=0, <3.7.46	v3.7.46	CVE-2026-81196	Sep 2, 2026
LOW CVSS 2.7	MasterStudy LMS < 3.7.42 - Instructor+ Cross-Tenant Order Billing PII Disclosure via IDOR CVE.org	>=0, <3.7.42	v3.7.42	CVE-2026-81200	Aug 29, 2026

Data aggregated from WPVulnerability, NVD/NIST, ENISA EUVD, CVE.org and WordPress.org. Provided as-is; verify with the plugin author before acting. Disclaimer.