Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 21

Export CSV
CVE-2026-62107

WordPress Masteriyo - LMS plugin <= 3.4.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in ThemeGrill Masteriyo - LMS learning-management-system allows Object Injection.This issue affects Masteriyo - LMS: from n/a through 3.4.0.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Masteriyo Wordpress
Products
Masteriyo Wordpress
CVE-2026-73996

WordPress Masteriyo - LMS plugin <= 2.3.2 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in ThemeGrill Masteriyo - LMS learning-management-system allows Upload a Web Shell to a Web Server.This issue affects Masteriyo - LMS: from n/a through 2.3.2.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Masteriyo Wordpress
Products
Masteriyo Wordpress
CVE-2026-62132

WordPress Masteriyo - LMS plugin <= 3.4.0 - Broken Access Control vulnerability

Subscriber Broken Access Control in Masteriyo - LMS <= 3.4.0 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Masteriyo Wordpress
Products
Masteriyo Wordpress
CVE-2026-8279

Masteriyo LMS <= 2.2.0 - Missing Authorization to Unauthenticated Arbitrary Course Progress Deletion

The Masteriyo LMS plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the 'delete_item_permissions_check' function in the CourseProgressItemsController in all versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to delete arbitrary course progress records belonging to any student.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Masteriyo Wordpress
Products
Masteriyo Lms – Lms Course Builder, Quizzes & Certificates Wordpress
CVE-2026-82846

Masteriyo LMS 1.18.0 - 2.3.3 - Instructor+ Stored XSS via Course Custom Fields

The Masteriyo LMS WordPress plugin before 3.4.0 does not sanitise and escape some course settings before outputting them in a page available to all visitors, allowing users with a course-author role to perform Stored Cross-Site Scripting attacks that run in the session of anyone viewing the course, including a logged-in administrator.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Masteriyo Wordpress
Products
Masteriyo Wordpress
CVE-2026-19712

Masteriyo LMS < 2.3.3 - Instructor+ Stored XSS via Quiz Description

The Masteriyo LMS WordPress plugin before 2.3.3 does not sanitise and escape a quiz field before outputting it back in a page, and grants its instructor role the ability to store unfiltered HTML, allowing such users to perform Stored Cross-Site Scripting attacks against any visitor of the affected page, including administrators. This affects default single-site installations. Sites running multisite, or defining DISALLOW_UNFILTERED_HTML, are not affected as the capability is not granted there.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Masteriyo Wordpress
Products
Masteriyo Wordpress
CVE-2026-59513

WordPress Masteriyo - LMS plugin <= 2.3.0 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in Masteriyo - LMS <= 2.3.0 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Masteriyo Wordpress
Products
Masteriyo Wordpress
CVE-2026-65463

WordPress Masteriyo - LMS plugin <= 2.3.1 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References (IDOR) in Masteriyo - LMS <= 2.3.1 versions.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Masteriyo Wordpress
Products
Masteriyo Wordpress
CVE-2026-13332

Masteriyo LMS < 2.3.1 - Unauthenticated Arbitrary User Session Termination (Denial of Service)

The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unauthenticated AJAX action used to clear user sessions, allowing unauthenticated attackers to terminate the active sessions (force-logout) of any user on the site, including administrators.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Masteriyo Wordpress
Products
Masteriyo Wordpress
CVE-2026-11773

Masteriyo LMS <= 2.2.1 - Missing Authorization to Authenticated (Student+) Arbitrary Course Announcement Modification

The Masteriyo LMS – LMS Course Builder, Quizzes & Certificates plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.2.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with student-level access and above, to modify the description (post content) of arbitrary course announcements authored by instructors or administrators.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Masteriyo Wordpress
Products
Masteriyo Lms – Lms Course Builder, Quizzes & Certificates Wordpress
CVE-2026-10824

Masteriyo LMS < 2.2.1 - Unauthenticated Course Progress Disclosure and Deletion

The Masteriyo LMS WordPress plugin before 2.2.1 does not perform authorization checks in a course-progress REST API controller, allowing unauthenticated users to read and permanently delete any user's course-progress records.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Masteriyo Wordpress
Products
Masteriyo Wordpress
CVE-2025-64270

WordPress Masteriyo - LMS plugin <= 2.0.3 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in masteriyo Masteriyo - LMS learning-management-system allows Retrieve Embedded Sensitive Data.This issue affects Masteriyo - LMS: from n/a through <= 2.0.3.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Masteriyo Wordpress
Products
Masteriyo Wordpress
CVE-2026-4484

Masteriyo LMS <= 2.1.6 - Missing Authorization to Authenticated (Student+) Privilege Escalation to Administrator

The Masteriyo LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.1.6. This is due to the plugin allowing a user to update the user role through the 'InstructorsController::prepare_object_for_database' function. This makes it possible for authenticated attackers, with Student-level access and above, to elevate their privileges to that of an administrator.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Masteriyo Wordpress
Products
Masteriyo Lms – Online Course Builder For Elearning, Lms & Education Wordpress
CVE-2025-54699

WordPress Masteriyo - LMS Plugin plugin <= 1.18.3 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in masteriyo Masteriyo - LMS learning-management-system allows Stored XSS.This issue affects Masteriyo - LMS: from n/a through <= 1.18.3.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Masteriyo Wordpress
Products
Masteriyo Wordpress
CVE-2024-43239

WordPress Masteriyo LMS plugin <= 1.11.4 - Insecure Direct Object Reference (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in masteriyo Masteriyo - LMS learning-management-system.This issue affects Masteriyo - LMS: from n/a through <= 1.11.4.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Masteriyo
Products
Masteriyo
CVE-2024-43159

WordPress Masteriyo LMS plugin <= 1.11.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in masteriyo Masteriyo - LMS learning-management-system.This issue affects Masteriyo - LMS: from n/a through <= 1.11.6.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Masteriyo
Products
Masteriyo
CVE-2024-43158

WordPress Masteriyo LMS plugin <= 1.11.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in masteriyo Masteriyo - LMS learning-management-system.This issue affects Masteriyo - LMS: from n/a through <= 1.11.4.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Masteriyo
Products
Masteriyo
CVE-2026-5167

Masteriyo LMS <= 2.1.7 - Unauthenticated Authorization Bypass to Arbitrary Order Completion via Stripe Webhook Endpoint

The Masteriyo LMS – Online Course Builder for eLearning, LMS & Education plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in versions up to and including 2.1.7. This is due to insufficient webhook signature verification in the handle_webhook() function. The webhook endpoint processes unauthenticated requests and only performs signature verification if both the webhook_secret setting is configured AND the HTTP_STRIPE_SIGNATURE header is present. Since webhook_secret defaults to an empty string, the webhook processes attacker-controlled JSON payloads without any verification. This makes it possible for unauthenticated attackers to send fake Stripe webhook events with arbitrary order_id values in the metadata, mark any order as completed without payment, and gain unauthorized access to paid course content.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Masteriyo Wordpress
Products
Masteriyo Lms – Online Course Builder For Elearning, Lms & Education Wordpress
CVE-2024-10000

Masteriyo LMS – eLearning and Online Course Builder for WordPress <= 1.13.3 - Authenticated (Student+) Stored Cross-Site Scripting via Ask a Question Functionality

The Masteriyo LMS – eLearning and Online Course Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the question's content parameter in all versions up to, and including, 1.13.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with student-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Masteriyo
Products
Masteriyo
CVE-2024-10008

Masteriyo LMS – eLearning and Online Course Builder for WordPress <= 1.13.3 - Authenticated (Student+) Missing Authorization to Privilege Escalation

The Masteriyo LMS – eLearning and Online Course Builder for WordPress plugin for WordPress is vulnerable to unauthorized user profile modification due to missing authorization checks on the /wp-json/masteriyo/v1/users/$id REST API endpoint in all versions up to, and including, 1.13.3. This makes it possible for authenticated attackers, with student-level access and above, to modify the roles of arbitrary users. As a result, attackers can escalate their privileges to the Administrator and demote existing administrators to students.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Masteriyo
Products
Masteriyo