Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 10

Export CSV
CVE-2026-112329

Sensei LMS 4.26.4 Broken Access Control via save_new_message

The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the legacy save_new_message handler hooked on the init action, which validates only a generic nonce without verifying course enrollment or restricting post_id to valid post types. Authenticated attackers, including unprivileged Subscribers, can supply an arbitrary post_id for any course, lesson, or quiz to create a private message addressed to that post's author, bypassing the enrollment checks enforced by the newer REST send-message controller.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Automattic Wordpress-extensions
Products
Sensei Lms Sensei Lms
CVE-2026-112328

Sensei LMS 4.26.4 Broken Access Control via add_new_module_term AJAX

The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the add_new_module_term AJAX handler that allows authenticated Teacher-role attackers to assign module taxonomy terms to arbitrary courses by supplying a crafted course_id, since the handler validates only a generic nonce and checks manage_options solely for slug prefixing rather than verifying course edit permissions. Attackers can reuse a nonce obtained from their own course metabox to call wp_set_object_terms against courses owned by other teachers or administrators, enabling unauthorized modification of course content they do not own.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Automattic Wordpress-extensions
Products
Sensei Lms Sensei Lms
CVE-2023-50875

WordPress Sensei LMS Plugin <= 4.17.0 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic Sensei LMS – Online Courses, Quizzes, & Learning allows Stored XSS.This issue affects Sensei LMS – Online Courses, Quizzes, & Learning: from n/a through 4.17.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Automattic
Products
Sensei Lms
CVE-2025-22740

WordPress Sensei LMS plugin <= 4.24.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in Automattic Sensei LMS sensei-lms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sensei LMS: from n/a through <= 4.24.4.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Automattic Wordpress
Products
Sensei Lms Wordpress
CVE-2024-35686

WordPress Sensei LMS plugin <= 4.23.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Automattic Sensei LMS, Automattic Sensei Pro (WC Paid Courses).This issue affects Sensei LMS: from n/a through 4.23.1; Sensei Pro (WC Paid Courses): from n/a through 4.23.1.1.23.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Automattic
Products
Sensei Lms Sensei Pro
CVE-2024-8009

Sensei LMS < 4.20.0 - Teacher+ Users Email Address Disclosure

The Sensei LMS WordPress plugin before 4.20.0 disclose all users of the blog including their email address to teachers on the students page

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Automattic
Products
Sensei Lms
CVE-2025-0466

Sensei LMS < 4.24.4 - Unauthenticated sensei_email/sensei_message Disclosure

The Sensei LMS WordPress plugin before 4.24.4 does not properly protect some its REST API routes, allowing unauthenticated attackers to leak sensei_email and sensei_message Information.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Automattic
Products
Sensei Lms
CVE-2024-7786

Sensei LMS < 4.24.2 - Unauthenticated Email Template Leak

The Sensei LMS WordPress plugin before 4.24.2 does not properly protect some its REST API routes, allowing unauthenticated attackers to leak email templates.

CVSS 3.1 · 7.5 High EPSS 1.7% KEV · Not listed
Vendors
Automattic
Products
Sensei Lms
CVE-2022-2080

Sensei LMS < 4.5.2 - Arbitrary Private Message Sending via IDOR

The Sensei LMS WordPress plugin before 4.5.2 does not ensure that the sender of a private message is either the teacher or the original sender, allowing any authenticated user to send messages to arbitrary private conversation via a IDOR attack. Note: Attackers are not able to see responses/messages between the teacher and student

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Automattic
Products
Sensei Lms
CVE-2022-2034

Sensei LMS < 4.5.0 - Unauthenticated Private Messages Disclosure via Rest API

The Sensei LMS WordPress plugin before 4.5.0 does not have proper permissions set in one of its REST endpoint, allowing unauthenticated users to access private messages sent to teachers

CVSS 3.1 · 5.3 Medium EPSS 2.7% KEV · Not listed
Vendors
Automattic
Products
Sensei Lms