Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?MasterStudy LMSMasterStudy LMS Pro
Plugin · masterstudy-lms-learning-management-system
MasterStudy LMS
52 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 22, 2026MasterStudy LMS: Does not verify that a user targeted through its student-enrolment feature has any relationship to the requesting instructorCVE-2026-88849 · fixed in 3.7.55 · reported by WPScanLow 2.7
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.55 does not verify that a user targeted through its student-enrolment feature has any relationship to the requesting instructor, allowing users with the Instructor role to overwrite the first name, last name and public display name of any registered user on the site, including administrators, enabling impersonation and phishing.
Oct 8, 2026MasterStudy LMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105079 · affects up to 3.7.52 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-management-system allows Stored XSS.This issue affects MasterStudy LMS: from n/a through 3.7.52.
Sep 24, 2026MasterStudy LMS: Does not verify that a user is enrolled in a course before recording lesson completions against itCVE-2026-88847 · fixed in 3.7.50 · reported by WPScanMedium 4.3
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that a user is enrolled in a course before recording lesson completions against it, allowing any authenticated user, such as a subscriber, to create course progress records for courses they have no access to.
Sep 24, 2026MasterStudy LMS: Does not check whether user registration is enabled on the site before creating an account through one of its front-end registration flowsCVE-2026-88846 · fixed in 3.7.50 · reported by WPScanMedium 5.3
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not check whether user registration is enabled on the site before creating an account through one of its front-end registration flows, allowing unauthenticated users to create accounts, and be logged into them, on sites where registration has been deliberately disabled.
Sep 24, 2026MasterStudy LMS: Does not perform any capability or nonce checks on an administrative maintenance actionCVE-2026-88845 · fixed in 3.7.50 · reported by WPScanMedium 4.3
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform any capability or nonce checks on an administrative maintenance action, allowing any authenticated user, such as a subscriber, to trigger it and create published content on the site attributed to their own account.
Sep 24, 2026MasterStudy LMS: Does not validate one of its display-style settings before using it to build a template pathCVE-2026-88843 · fixed in 3.7.50 · reported by WPScanHigh 7.2
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not validate one of its display-style settings before using it to build a template path, allowing users with the Contributor role and above to include and execute arbitrary local PHP files on the server. An equivalent path was corrected in an earlier release and this one was not, so the issue persists in versions the earlier advisory reports as fixed.
Sep 23, 2026MasterStudy LMS: Does not perform a per-object ownership checkCVE-2026-81339 · fixed in 3.7.50 · reported by WPScanMedium 4.3
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform a per-object ownership check when returning a quiz attempt result, allowing any authenticated user with a minimal (subscriber) role to read other students' quiz grades, pass/fail status and attempt timestamps by referencing an attempt identifier belonging to another user.
Sep 23, 2026MasterStudy LMS: Does not properly sanitise and restrict HTML in user-submitted content before storing it and rendering it to other usersCVE-2026-81338 · fixed in 3.7.50 · reported by WPScanMedium 4.6
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not properly sanitise and restrict HTML in user-submitted content before storing it and rendering it to other users, allowing users with subscriber-level accounts and above to perform stored HTML injection, such as embedding iframes, that can be leveraged for phishing and content spoofing against other users viewing the content.
Sep 18, 2026MasterStudy LMS: Does not verify that the requesting user owns the course before returning its enrolled-student dataCVE-2026-88844 · fixed in 3.7.50 · reported by WPScanLow 2.7
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that the requesting user owns the course before returning its enrolled-student data, allowing users with the MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50's Instructor role to disclose the names and email addresses of students enrolled in other instructors' courses.
Sep 18, 2026MasterStudy LMS: Does not perform per-object ownership or capability checksCVE-2026-81340 · fixed in 3.7.50 · reported by WPScanLow 3.8
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating orders through its REST API, allowing users with the Instructor role to modify any order on the site, granting free course enrolment, revoking other users' paid enrolments, and tampering with order notes.
Sep 2, 2026MasterStudy LMS: Does not perform an authorization check before returning a student's learning statisticsCVE-2026-81199 · fixed in 3.7.46 · reported by WPScanMedium 5.3
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning a student's learning statistics, allowing unauthenticated attackers to disclose the course counts, points, certificates, quiz and assignment totals of any registered user.
Sep 2, 2026MasterStudy LMS: Does not properly verify ownership of a curriculum object before acting on itCVE-2026-81198 · fixed in 3.7.46 · reported by WPScanLow 3.8
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of a curriculum object before acting on it, allowing authenticated users with the instructor role to delete or modify curriculum sections and materials belonging to courses owned by other instructors.
Sep 2, 2026MasterStudy LMS: Does not restrict access to a REST route that lists an author's coursesCVE-2026-81197 · fixed in 3.7.46 · reported by WPScanMedium 5.3
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not restrict access to a REST route that lists an author's courses, nor does it filter that listing by publication status, allowing unauthenticated users to read the titles and IDs of unpublished (draft, pending and private) courses.
Sep 2, 2026MasterStudy LMS: Does not properly verify ownership of quiz question identifiersCVE-2026-81196 · fixed in 3.7.46 · reported by WPScanLow 2.7
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of quiz question identifiers, allowing users with instructor access to read other instructors' quiz questions, including the correct answers and explanations.
Sep 2, 2026MasterStudy LMS: Does not perform an authorization check before returning per-student course enrollment and progress dataCVE-2026-81195 · fixed in 3.7.46 · reported by WPScanMedium 5.3
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning per-student course enrollment and progress data, allowing unauthenticated attackers to disclose the enrolled courses and learning progress of any registered user.
Sep 2, 2026MasterStudy LMS: Does not properly verify authorizationCVE-2026-81194 · fixed in 3.7.46 · reported by WPScanMedium 4.3
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify authorization when retrieving order line-item data, allowing any authenticated user including Subscribers to read other instructors' course sales records by supplying another user's identifier.
Aug 29, 2026MasterStudy LMS: Does not validate a redirect parameter supplied during user registration before using itCVE-2026-81342 · fixed in 3.7.43 · reported by WPScanMedium 4.7
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.43 does not validate a redirect parameter supplied during user registration before using it, allowing unauthenticated attackers to redirect users to arbitrary external URLs.
Aug 29, 2026MasterStudy LMS: Does not correctly restrict access to order informationCVE-2026-81200 · fixed in 3.7.42 · reported by WPScanLow 2.7
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.42 does not correctly restrict access to order information, allowing any user with the instructor role to read other users' order billing details, including name, email address, phone number and postal address, by enumerating order IDs.
Aug 29, 2026MasterStudy LMS: Does not verify the amountCVE-2026-81026 · fixed in 3.7.40 · reported by WPScanMedium 4.8
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.40 does not verify the amount, receiver, currency or status of a payment notification before marking the corresponding order completed, allowing unauthenticated users to complete full-price orders and gain access to paid content by paying only a token amount.
Aug 24, 2026Unauthenticated Arbitrary File Deletion in MasterStudy LMS <= 3.7.42 versions.CVE-2026-78284 · affects up to 3.7.42 · reported by PatchstackHigh 8.6
Unauthenticated Arbitrary File Deletion in MasterStudy LMS <= 3.7.42 versions.
Aug 18, 2026Subscriber Broken Access Control in MasterStudy LMS <= 3.7.41 versions.CVE-2026-73404 · affects up to 3.7.41 · reported by PatchstackMedium 6.5
Subscriber Broken Access Control in MasterStudy LMS <= 3.7.41 versions.
Aug 18, 2026Subscriber Privilege Escalation in MasterStudy LMS <= 3.7.41 versions.CVE-2026-68568 · affects up to 3.7.41 · reported by PatchstackMedium 6.3
Subscriber Privilege Escalation in MasterStudy LMS <= 3.7.41 versions.
Jul 31, 2026MasterStudy LMS: Insufficient Verification of Data AuthenticityCVE-2026-28145 · affects up to 3.7.39 · reported by PatchstackMedium 5.3
Insufficient Verification of Data Authenticity vulnerability in StylemixThemes MasterStudy LMS allows Manipulating User State. This issue affects MasterStudy LMS: from n/a through 3.7.39.
Jul 29, 2026MasterStudy LMS WordPress Plugin – for Online Courses and Education: Insecure Direct Object ReferenceCVE-2026-5060 · affects up to 3.7.14 · reported by WordfenceMedium 6.5
The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.14. This is due to the `stm_lms_delete_cover()` function lacking ownership validation on the `file_id` parameter before passing it to `wp_delete_attachment()`. This makes it possible for authenticated attackers, with Instructor-level access and above, to delete arbitrary attachments belonging to any user by enumerating sequential attachment IDs.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 29, 2026Subscriber Cross Site Scripting (XSS) in MasterStudy LMS <= 3.7.27 versions.CVE-2026-57330 · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in MasterStudy LMS <= 3.7.27 versions.
Jun 26, 2026Subscriber Broken Access Control in MasterStudy LMS <= 3.7.30 versions.CVE-2026-57640 · reported by PatchstackMedium 4.3
Subscriber Broken Access Control in MasterStudy LMS <= 3.7.30 versions.
Jun 15, 2026Subscriber SQL Injection in MasterStudy LMS <= 3.7.25 versions.CVE-2026-40766 · affects up to 3.7.25 · reported by PatchstackHigh 8.5
Subscriber SQL Injection in MasterStudy LMS <= 3.7.25 versions.
May 27, 2026MasterStudy LMS: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-42730 · affects up to 3.7.29 · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Blind SQL Injection.This issue affects MasterStudy LMS: from n/a through <= 3.7.29.
Apr 16, 2026MasterStudy LMS WordPress Plugin for Online Courses and Education: Time-based Blind SQL InjectionCVE-2026-4817 · affects up to 3.7.25 · reported by WordfenceMedium 6.5
The MasterStudy LMS WordPress Plugin for Online Courses and Education plugin for WordPress is vulnerable to Time-based Blind SQL Injection via the 'order' and 'orderby' parameters in the /lms/stm-lms/order/items REST API endpoint in versions up to and including 3.7.25. This is due to insufficient input sanitization combined with a design flaw in the custom Query builder class that allows unquoted SQL injection in ORDER BY clauses. When the Query builder detects parentheses in the sort_by parameter, it treats the value as a SQL function and directly concatenates it into the ORDER BY clause without any quoting. While esc_sql() is applied to escape quotes and backslashes, this cannot prevent ORDER BY injection when the values themselves are not wrapped in quotes in the resulting SQL statement. This makes it possible for authenticated attackers, with subscriber-level access and above, to append arbitrary SQL queries via the ORDER BY clause to extract sensitive information from the database including user credentials, session tokens, and other confidential data through time-based blind SQL injection techniques.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 14, 2026MasterStudy LMS WordPress Plugin – for Online Courses and Education: Stored Cross-Site ScriptingCVE-2026-0559 · affects up to 3.7.11 · reported by WordfenceMedium 6.4
The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'stm_lms_courses_grid_display' shortcode in all versions up to, and including, 3.7.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Jan 6, 2026MasterStudy LMS WordPress Plugin – for Online Courses and Education: Unauthorized modification and deletion of dataCVE-2025-13766 · affects up to 3.7.6 · reported by WordfenceMedium 5.4
The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to unauthorized modification and deletion of data due to a missing capability checks on multiple REST API endpoints in all versions up to, and including, 3.7.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload or delete arbitrary media files, delete or modify posts, and create/manage course templates
Oct 31, 2025MasterStudy LMS: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-64366 · affects up to 3.6.27 · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Blind SQL Injection.This issue affects MasterStudy LMS: from n/a through <= 3.6.27.
Oct 22, 2025MasterStudy LMS: Exposure of Sensitive System Information to an Unauthorized Control SphereCVE-2025-59575 · affects up to 3.6.20 · reported by PatchstackMedium 4.9
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Retrieve Embedded Sensitive Data.This issue affects MasterStudy LMS: from n/a through <= 3.6.20.
Sep 22, 2025MasterStudy LMS: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')CVE-2025-59577 · affects up to 3.6.20 · reported by PatchstackMedium 4.3
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Leveraging Race Conditions.This issue affects MasterStudy LMS: from n/a through <= 3.6.20.
Sep 22, 2025MasterStudy LMS: Missing AuthorizationCVE-2025-59576 · affects up to 3.6.20 · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MasterStudy LMS: from n/a through <= 3.6.20.
Sep 5, 2025MasterStudy LMS: Missing AuthorizationCVE-2025-54744 · affects up to 3.6.15 · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MasterStudy LMS: from n/a through <= 3.6.15.
Apr 4, 2025MasterStudy LMS: Missing AuthorizationCVE-2025-32237 · affects up to 3.5.28 · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MasterStudy LMS: from n/a through <= 3.5.28.
Apr 4, 2025MasterStudy LMS: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-32141 · affects up to 3.5.28 · reported by PatchstackHigh 8.8
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows PHP Local File Inclusion.This issue affects MasterStudy LMS: from n/a through <= 3.5.28.
Jan 2, 2025MasterStudy LMS: Cross-Site Request Forgery (CSRF)CVE-2024-37093 · affects up to 3.2.1 · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Cross Site Request Forgery.This issue affects MasterStudy LMS: from n/a through <= 3.2.1.
Nov 1, 2024MasterStudy LMS: Missing AuthorizationCVE-2024-37094 · affects up to 3.2.12 · reported by PatchstackHigh 8.2
Missing Authorization vulnerability in StylemixThemes MasterStudy LMS allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MasterStudy LMS: from n/a through 3.2.12.
Jul 22, 2024MasterStudy LMS: Does not prevent students from creating instructor accountsCVE-2024-5973 · fixed in 3.3.24 · reported by WPScanHigh 8.8
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.3.24 does not prevent students from creating instructor accounts, which could be used to get access to functionalities they shouldn't have.
May 2, 2024MasterStudy LMS WordPress Plugin – for Online Courses and Education: Unauthorized access, modification, and loss of dataCVE-2024-3942 · affects up to 3.3.8 · reported by WordfenceMedium 6.3
The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on several functions in versions up to, and including, 3.3.8. This makes it possible for authenticated attackers, with subscriber level permissions and above, to read and modify content such as course questions, post titles, and taxonomies.
Apr 9, 2024MasterStudy LMS: Local File InclusionCVE-2024-3136 · affects up to 3.3.3 · reported by WordfenceCritical 9.8
The MasterStudy LMS plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.3 via the 'template' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 9, 2024MasterStudy LMS: Unauthorized access of dataCVE-2024-1904 · affects up to 3.2.13 · reported by WordfenceMedium 4.3
The MasterStudy LMS plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the search_posts function in all versions up to, and including, 3.2.13. This makes it possible for authenticated attackers, with subscriber-level access and above, to expose draft post titles and excerpts.
Mar 29, 2024MasterStudy LMS: Local File InclusionCVE-2024-2411 · affects up to 3.3.0 · reported by WordfenceCritical 9.8
The MasterStudy LMS plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.0 via the 'modal' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Mar 29, 2024MasterStudy LMS: Privilege EscalationCVE-2024-2409 · affects up to 3.3.1 · reported by WordfenceCritical 9.8
The MasterStudy LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.3.1. This is due to insufficient validation checks within the _register_user() function called by the 'wp_ajax_nopriv_stm_lms_register' AJAX action. This makes it possible for unauthenticated attackers to register a user with administrator-level privileges when MasterStudy LMS Pro is installed and the LMS Forms Editor add-on is enabled.
Mar 13, 2024MasterStudy LMS WordPress Plugin – for Online Courses and Education: Information ExposureCVE-2024-2106 · affects up to 3.2.10 · reported by WordfenceMedium 5.3
The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Information Exposure in versions up to, and including, 3.2.10. This can allow unauthenticated attackers to extract sensitive data including all registered user's username and email addresses which can be used to help perform future attacks.
NVD recordplugins.svn.wordpress.orgplugins.svn.wordpress.org
Feb 17, 2024MasterStudy LMS WordPress Plugin – for Online Courses and Education: Union based SQL InjectionCVE-2024-1512 · affects up to 3.2.5 · reported by WordfenceCritical 9.8
The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to union based SQL Injection via the 'user' parameter of the /lms/stm-lms/order/items REST route in all versions up to, and including, 3.2.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Sep 11, 2023MasterStudy LMS: Does not have proper checks in place during registration allowing anyone to register on the siteCVE-2023-4278 · fixed in 3.0.18 · reported by WPScanHigh 7.5
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.0.18 does not have proper checks in place during registration allowing anyone to register on the site as an instructor. They can then add courses and/or posts.
Jun 22, 2023Broken Access Control vulnerability in StylemixThemes MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin <= 3.0.8 versions allows any loCVE-2023-35093 · affects up to 3.0.8 · reported by PatchstackMedium 6.5
Broken Access Control vulnerability in StylemixThemes MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin <= 3.0.8 versions allows any logged-in users, such as subscribers to view the "Orders" of the plugin and get the data related to the order like email, username, and more.
Jun 22, 2023Auth.CVE-2023-35090 · affects up to 3.0.7 · reported by PatchstackMedium 6.5
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in StylemixThemes MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin <= 3.0.7 versions.
Mar 7, 2022MasterStudy LMS: Does to validate some parameters givenCVE-2022-0441 · fixed in 2.7.6 · reported by WPScanCritical 9.8
The MasterStudy LMS WordPress plugin before 2.7.6 does to validate some parameters given when registering a new account, allowing unauthenticated users to register as an admin
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.