ML
Product
MasterStudy LMS WordPress Plugin – for Online Courses and Education
11
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 4High 1Medium 6Low 0
Watch
Add MasterStudy LMS WordPress Plugin – for Online Courses and Education to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-3136 | 9.8 | Apr 9 | MasterStudy LMS <= 3.3.3 - Unauthenticated Local File Inclusion via template Affected: through 3.3.3 |
| CVE-2024-2411 | 9.8 | Mar 29 | MasterStudy LMS <= 3.3.0 - Unauthenticated Local File Inclusion via modal Affected: through 3.3.0 |
| CVE-2024-2409 | 9.8 | Mar 29 | MasterStudy LMS <= 3.3.1 - Unauthenticated Privilege Escalation via stm_lms_register AJAX Action Affected: through 3.3.1 |
| CVE-2024-1512 | 9.8 | Feb 17 | MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.2.5 - Unauthenticated SQL Injection Affected: through 3.2.5 |
| CVE-2024-2106 | 7.5 | Mar 13 | MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.2.10 - Basic Information Exposure via REST route Affected: through 3.2.10 |
| CVE-2026-5060 | 6.5 | Jul 29 | MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.14 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Attachment Deletion Affected: through 3.7.23 |
| CVE-2026-4817 | 6.5 | Apr 17 | MasterStudy LMS <= 3.7.25 - Authenticated (Subscriber+) Time-based Blind SQL Injection via 'order' and 'orderby' Parameters Affected: through 3.7.25 |
| CVE-2026-0559 | 6.4 | Feb 14 | MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'stm_lms_courses_grid_display' Shortcode Affected: through 3.7.11 |
| CVE-2025-13766 | 5.4 | Jan 6 | MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.6 Missing Authorization to Authenticated (Subscriber+) Posts and Media Creation, Modification and Deletion Affected: through 3.7.6 |
| CVE-2024-3942 | 5.4 | May 2 | MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.3.8 - Missing Authorization Affected: through 3.3.8 |
| CVE-2024-1904 | 4.3 | Apr 9 | MasterStudy LMS <= 3.2.13 - Missing Authorization to Sensitive Information Exposure in search_posts Affected: through 3.2.13 |
Showing 11