CVE-2026-119478

WordPress MasterStudy LMS plugin <= 3.7.56 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-management-system allows Code Injection.This issue affects MasterStudy LMS: from n/a through 3.7.56.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Stylemixthemes Wordpress-extensions

Products

Masterstudy Lms Masterstudy Lms

CVE-2026-118092

WordPress MasterStudy LMS plugin <= 3.7.55 - Broken Access Control vulnerability

Missing Authorization vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-management-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MasterStudy LMS: from n/a through 3.7.55.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Masterstudy Lms

CVE-2026-105079

WordPress MasterStudy LMS plugin <= 3.7.52 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-management-system allows Stored XSS.This issue affects MasterStudy LMS: from n/a through 3.7.52.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Stylemixthemes Wordpress-extensions

Products

Masterstudy Lms Masterstudy Lms

CVE-2026-81340

MasterStudy LMS < 3.7.50 - Instructor+ Order Status Manipulation via IDOR

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating orders through its REST API, allowing users with the Instructor role to modify any order on the site, granting free course enrolment, revoking other users' paid enrolments, and tampering with order notes.

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed

Vendors

Stylemix Wordpress-extensions

Products

Masterstudy Lms Wordpress Plugin Masterstudy Lms

CVE-2026-81338

MasterStudy LMS < 3.7.50 - Subscriber+ Stored HTML Injection via Course Discussions

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not properly sanitise and restrict HTML in user-submitted content before storing it and rendering it to other users, allowing users with subscriber-level accounts and above to perform stored HTML injection, such as embedding iframes, that can be leveraged for phishing and content spoofing against other users viewing the content.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Masterstudy Lms

CVE-2026-81339

MasterStudy LMS < 3.7.50 - Subscriber+ Quiz Attempt Grade Disclosure via IDOR

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform a per-object ownership check when returning a quiz attempt result, allowing any authenticated user with a minimal (subscriber) role to read other students' quiz grades, pass/fail status and attempt timestamps by referencing an attempt identifier belonging to another user.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Masterstudy Lms

CVE-2026-88843

MasterStudy LMS 3.5.29 - < 3.7.50 - Contributor+ LFI via Elementor Courses Categories Widget

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not validate one of its display-style settings before using it to build a template path, allowing users with the Contributor role and above to include and execute arbitrary local PHP files on the server. An equivalent path was corrected in an earlier release and this one was not, so the issue persists in versions the earlier advisory reports as fixed.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Masterstudy Lms

CVE-2026-88845

MasterStudy LMS 2.3.0 - < 3.7.50 - Subscriber+ Course and Lesson Creation via Demo Import

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform any capability or nonce checks on an administrative maintenance action, allowing any authenticated user, such as a subscriber, to trigger it and create published content on the site attributed to their own account.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Masterstudy Lms

CVE-2026-88846

MasterStudy LMS 2.3.0 - < 3.7.50 - Unauthenticated Account Creation with Registration Disabled

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not check whether user registration is enabled on the site before creating an account through one of its front-end registration flows, allowing unauthenticated users to create accounts, and be logged into them, on sites where registration has been deliberately disabled.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Masterstudy Lms

CVE-2026-88847

MasterStudy LMS < 3.7.50 - Subscriber+ Lesson Completion Record Creation

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that a user is enrolled in a course before recording lesson completions against it, allowing any authenticated user, such as a subscriber, to create course progress records for courses they have no access to.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Masterstudy Lms

CVE-2026-88848

MasterStudy LMS 1.9 - < 3.7.50 - Subscriber+ Membership Plan Quota and Category Restriction Bypass

The MasterStudy LMS WordPress plugin from 1.9 before 3.7.50 does not verify that a course a member asks to enrol in is covered by their membership plan, nor that the plan identifier submitted with the request is one they actually hold, allowing any member to enrol themselves into restricted paid courses outside their plan and beyond the number of courses it entitles them to.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Masterstudy Lms