WordPress plugin
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 33 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical2
- High5
- Medium26
- Low0
All Masteriyo LMS – LMS Course Builder, Quizzes & Certificates vulnerabilities
- Medium5.3Unauthenticated Arbitrary Content Deletion
≤3.4.3Update to 3.5.0
- Medium4.3Authenticated (Subscriber+) Information Exposure
≤3.4.1Update to 3.4.2
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
≤3.4.1Update to 3.4.2
- Medium4.33.4.0 - Authenticated (Custom Role+) Insecure Direct Object Reference
1.14.0 – 3.4.0Update to 3.4.1
- Medium6.4Authenticated (Custom Role+) Stored Cross-Site Scripting
<3.4.1Update to 3.4.1
- High8.1Unauthenticated PHP Object Injection
≤3.4.0Update to 3.4.1
- Medium4.3Missing Authorization
≤3.4.0Update to 3.4.1
- High7.5Authenticated (Subscriber+) PHP Object Injection
≤3.4.0Update to 3.4.1
- Medium5.32.3.3 - Unauthenticated Information Exposure
1.3.1 – 2.3.3Update to 3.4.0
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Course Progress Deletion
≤2.2.0Update to 2.2.1
- Medium6.42.3.3 - Authenticated (Custom Role+) Stored Cross-Site Scripting
1.18.0 – 2.3.3Update to 3.4.0
- Medium6.4Authenticated (Custom Role+) Stored Cross-Site Scripting
<2.3.3Update to 2.3.3
- Critical9.8Unauthenticated Arbitrary File Upload
≤2.3.2Update to 2.3.3
- Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
≤2.3.1Update to 2.3.2
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
≤2.3.0Update to 2.3.1
- Medium5.3Missing Authorization to Unauthenticated User Session Termination
≤2.3.0Update to 2.3.1
- Medium4.3Missing Authorization to Authenticated (Student+) Arbitrary Course Announcement Modification
≤2.2.1Update to 2.3.0
- High8.8Authenticated (Subscriber+) Privilege Escalation
≤2.2.0Update to 2.2.1
- Medium5.3Missing Authorization to Unauthenticated Course Progress Disclosure and Deletion
≤2.2.0Update to 2.2.1
- Medium5.3Missing Authorization
≤2.1.8Update to 2.1.9
- Medium5.3Missing Authorization
≤2.1.5Update to 2.1.6
- Medium5.3Unauthenticated Authorization Bypass to Arbitrary Order Completion via Stripe Webhook Endpoint
≤2.1.7Update to 2.1.8
- High8.8Missing Authorization to Authenticated (Student+) Privilege Escalation to Administrator
≤2.1.6Update to 2.1.7
- Medium4.3LMS <= 2.0.3 - Authenticated (Subscriber+) Sensitive Information Exposure
≤2.0.3Update to 2.0.4
- Medium6.4LMS <= 1.18.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
≤1.18.3Update to 1.18.4
- Medium6.4Authenticated (Student+) Stored Cross-Site Scripting via Ask a Question Functionality
≤1.13.3Update to 1.13.4
- High8.8Authenticated (Student+) Missing Authorization to Privilege Escalation
≤1.13.3Update to 1.13.4
- Medium5.3LMS <= 1.11.4 - Authenticated (Student+) Insecure Direct Object Reference
≤1.11.4Update to 1.11.5
- Medium5.3LMS <= 1.11.4 - Missing Authorization
≤1.11.4Update to 1.11.5
- Medium5.3LMS <= 1.11.6 - Missing Authorization
≤1.11.6Update to 1.12.0
- Medium5.3LMS <= 1.7.3 - Insecure Direct Object Reference
≤1.7.3Update to 1.7.4
- Critical9.8LMS <= 1.7.2 - Unauthenticated Privilege Escalation
≤1.7.2Update to 1.7.3
- Medium6.5LMS for WordPress <= 1.6.7 - Sensitive Information Exposure
<1.6.8Update to 1.6.8
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates: common questions
Does Masteriyo LMS – LMS Course Builder, Quizzes & Certificates have known vulnerabilities?
Yes. VulnCrest Radar lists 33 known vulnerabilities in Masteriyo LMS – LMS Course Builder, Quizzes & Certificates: 2 critical, 5 high, 26 medium. None are known to affect version null.
How do I check which version of Masteriyo LMS – LMS Course Builder, Quizzes & Certificates I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Masteriyo LMS – LMS Course Builder, Quizzes & Certificates vulnerability?
CVE-2026-116410, published Oct 30, 2026: Masteriyo LMS – LMS Course Builder, Quizzes & Certificates <= 3.4.3 - Unauthenticated Arbitrary Content Deletion. Severity: Medium (CVSS 5.3).
Is any Masteriyo LMS – LMS Course Builder, Quizzes & Certificates vulnerability listed in CISA KEV?
No. None of the known Masteriyo LMS – LMS Course Builder, Quizzes & Certificates vulnerabilities is currently listed in the CISA KEV catalog.