VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

MasterStudy LMS WordPress Plugin – for Online Courses and Education security & vulnerabilities

masterstudy-lms-learning-management-system— active installsLast vulnerability Nov 7, 2026

Unpatched vulnerability in the latest version

At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.

Watch plugin
60Known vulnerabilities
  • Critical6
  • High6
  • Medium48
  • Low0
Vulnerabilities per year
2022: 1 vulnerability1222023: 5 vulnerabilities5232024: 10 vulnerabilities10242025: 7 vulnerabilities7252026: 37 vulnerabilities3726

All MasterStudy LMS WordPress Plugin – for Online Courses and Education vulnerabilities

MasterStudy LMS WordPress Plugin – for Online Courses and Education vulnerabilities
SeverityVulnerabilityCVEPublished
Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Exeuction
≤3.7.56Update to 3.7.57
CVE-2026-119478
High7.5Authenticated (Subscriber+) PHP Object Injection
≤3.7.55Update to 3.7.56
CVE-2026-118090
Medium4.3Missing Authorization
≤3.7.55Update to 3.7.56
CVE-2026-118092
Medium4.3Missing Authorization
≤3.7.49Update to 3.7.50
CVE-2026-80069
Medium4.3Authenticated (Custom+) Path Traversal
≤3.7.49Update to 3.7.50
CVE-2026-80067
Medium4.33.7.54 - Missing Authorization
3.7.13 – 3.7.54Update to 3.7.55
CVE-2026-88849
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.7.52Update to 3.7.53
CVE-2026-105079
High7.5 3.7.49 - Authenticated (Contributor+) Local File Inclusion
3.5.29 – 3.7.49Update to 3.7.50
CVE-2026-88843
Medium4.3Missing Authorization
≤3.7.49Update to 3.7.50
CVE-2026-88845
Medium4.3Unauthenticated (Subscriber+) Unauthorized Course Enrollment
≤3.7.49Update to 3.7.50
CVE-2026-88848
Medium4.3Missing Authorization
≤3.7.49Update to 3.7.50
CVE-2026-88847
Medium5.3Missing Authorization to Account Registration
≤3.7.49Update to 3.7.50
CVE-2026-88846
Medium6.3Authenticated (Subscriber+) HTML Injection
≤3.7.49Update to 3.7.50
CVE-2026-81338
Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
≤3.7.49Update to 3.7.50
CVE-2026-81339
Medium4.3Authenticated (Instructor+) Insecure Direct Object Reference
≤3.7.49Update to 3.7.50
CVE-2026-88844
Medium4.3Authenticated (Instructor+) Insecure Direct Object Reference
≤3.7.49Update to 3.7.50
CVE-2026-81340
Medium4.3Authenticated (Custom Role+) Insecure Direct Object Reference
<3.7.46Update to 3.7.46
CVE-2026-81196
Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
<3.7.46Update to 3.7.46
CVE-2026-81194
Medium5.3Unauthenticated Information Exposure
<3.7.46Update to 3.7.46
CVE-2026-81199
Medium5.3Missing Authorization
<3.7.46Update to 3.7.46
CVE-2026-81195
Medium4.3Authenticated (Custom Role+) Insecure Direct Object Reference
<3.7.46Update to 3.7.46
CVE-2026-81198
Medium5.3Unauthenticated Unpublished Course Data Exposure
<3.7.46Update to 3.7.46
CVE-2026-81197
Medium4.3Authenticated (Custom Role+) Insecure Direct Object Reference
<3.7.42Update to 3.7.42
CVE-2026-81200
High7.2Unauthenticated Open Redirect
<3.7.43Update to 3.7.43
CVE-2026-81342
Medium5.3Unauthenticated Payment Bypass
<3.7.40Update to 3.7.40
CVE-2026-81026
Critical9.1Unauthenticated Arbitrary File Deletion
≤3.7.42Update to 3.7.43
CVE-2026-78284
Medium4.3Missing Authorization
≤3.7.41Update to 3.7.42
CVE-2026-73404
Medium6.3Authenticated (Subscriber+) Privilege Escalation
≤3.7.41Update to 3.7.42
CVE-2026-68568
Medium5.3Missing Authorization
≤3.7.39Update to 3.7.40
CVE-2026-28145
Medium6.5Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Attachment Deletion
≤3.7.23Update to 3.7.24
CVE-2026-5060
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
≤3.7.27Update to 3.7.28
CVE-2026-57330
Medium4.3Missing Authorization
≤3.7.30Update to 3.7.31
CVE-2026-57640
Medium6.5Authenticated (Subscriber+) SQL Injection
≤3.7.29Update to 3.7.30
CVE-2026-42730
Medium6.5Authenticated (Subscriber+) SQL Injection
≤3.7.25Update to 3.7.26
CVE-2026-40766
Medium6.5Authenticated (Subscriber+) Time-based Blind SQL Injection via 'order' and 'orderby' Parameters
≤3.7.25Update to 3.7.26
CVE-2026-4817
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'stm_lms_courses_grid_display' Shortcode
≤3.7.11Update to 3.7.12
CVE-2026-0559
Medium5.4MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.6 Missing Authorization to Authenticated (Subscriber+) Posts and Media Creation, Modification and Deletion
≤3.7.6Update to 3.7.7
CVE-2025-13766
Medium6.5Authenticated (Instructor+) SQL Injection
≤3.6.27Update to 3.6.28
CVE-2025-64366
Medium4.3Authenticated (Instructor+) Sensitive Information Exposure
≤3.6.20Update to 3.6.21
CVE-2025-59575
Medium4.3Authenticated (Subscriber+) Race Condition to Multiple Reviews
≤3.6.20Update to 3.6.21
CVE-2025-59577
Medium4.3Missing Authorization
≤3.6.20Update to 3.6.21
CVE-2025-59576
Medium4.3Missing Authorization
≤3.6.15Update to 3.6.16
CVE-2025-54744
High8.8Authenticated (Contributor+) Local File Inclusion
≤3.5.28Update to 3.5.29
CVE-2025-32141
Medium4.3Missing Authorization
≤3.5.28Update to 3.5.29
CVE-2025-32237
High7.3Unauthenticated Limited Privilege Escalation to Instructor
≤3.3.23Update to 3.3.24
CVE-2024-5973
Medium5.3Missing Authorization
≤3.2.12Update to 3.2.13
CVE-2024-37094
Medium4.3Cross-Site Request Forgery
≤3.2.1Update to 3.2.2
CVE-2024-37093
Medium6.3Missing Authorization
≤3.3.8Update to 3.3.9
CVE-2024-3942
Critical9.8Unauthenticated Local File Inclusion via template
≤3.3.3Update to 3.3.4
CVE-2024-3136
Critical9.8Unauthenticated Privilege Escalation via stm_lms_register AJAX Action
≤3.3.1Update to 3.3.2
CVE-2024-2409
Critical9.8Unauthenticated Local File Inclusion via modal
≤3.3.0Update to 3.3.1
CVE-2024-2411
Medium4.3Missing Authorization to Sensitive Information Exposure in search_posts
≤3.2.13Update to 3.3.0
CVE-2024-1904
Medium5.3Basic Information Exposure via REST route
≤3.2.10Update to 3.2.11
CVE-2024-2106
Critical9.8Unauthenticated SQL Injection
≤3.2.5Update to 3.2.6
CVE-2024-1512
High7.3Privilege Escalation
≤3.0.17Update to 3.0.18
CVE-2023-4278
Medium6.1Reflected Cross-Site Scripting via fs_request_get
≤1.9.2No patch available
CVE-2023-33999
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤3.0.8Update to 3.0.9
CVE-2023-35090
Medium4.3Missing Authorization to Course Category Creation
≤3.0.8Update to 3.0.9
CVE-2023-35093
Medium4.3Missing Authorization via wp_ajax_stm_wpcfto_get_settings
≤2.9.34Update to 2.9.35
—
Critical9.8Unauthenticated Admin Account Creation
≤2.7.5Update to 2.7.6
CVE-2022-0441

MasterStudy LMS WordPress Plugin – for Online Courses and Education: common questions

Does MasterStudy LMS WordPress Plugin – for Online Courses and Education have known vulnerabilities?

Yes. VulnCrest Radar lists 60 known vulnerabilities in MasterStudy LMS WordPress Plugin – for Online Courses and Education: 6 critical, 6 high, 48 medium. At least one is not fixed in the latest version.

How do I check which version of MasterStudy LMS WordPress Plugin – for Online Courses and Education I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent MasterStudy LMS WordPress Plugin – for Online Courses and Education vulnerability?

CVE-2026-119478, published Nov 7, 2026: MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.56 - Authenticated (Subscriber+) Arbitrary Shortcode Exeuction. Severity: Medium (CVSS 5.4).

Is any MasterStudy LMS WordPress Plugin – for Online Courses and Education vulnerability listed in CISA KEV?

No. None of the known MasterStudy LMS WordPress Plugin – for Online Courses and Education vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?