Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
6 results
Oct 22, 2026MasterStudy LMS: Does not verify that a user targeted through its student-enrolment feature has any relationship to the requesting instructorCVE-2026-88849 · WordPress plugins & themes · reported by WPScanLow 2.7
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.55 does not verify that a user targeted through its student-enrolment feature has any relationship to the requesting instructor, allowing users with the Instructor role to overwrite the first name, last name and public display name of any registered user on the site, including administrators, enabling impersonation and phishing.
- Product
- MasterStudy LMS
- Fixed in
- 3.7.55
- What to do
- Update MasterStudy LMS to 3.7.55 or newer.
Sep 3, 2026LearnPress WordPress Plugin before 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers with the Instructor role to inCVE-2026-82024 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
LearnPress WordPress Plugin before 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers with the Instructor role to inject persistent malicious payloads by submitting unsanitized input into quiz question answer title fields. Attackers can store arbitrary JavaScript through the answer title parameter, which is rendered through an unescaped HTML sink to execute in the browsers of any user who views the affected quiz question, including students, other instructors, and administrators.
- Fixed in
- 4.4.6
- What to do
- Update the plugin to 4.4.6 or newer.
Full record and what to do →NVD recordwordpress.orgvulncheck.com
Sep 3, 2026LearnPress WordPress Plugin before 4.4.6 contains a broken object-level authorization vulnerability that allows authenticated attackers with the Instructor roleCVE-2026-82023 · WordPress plugins & themes · reported by VulnCheckMedium 5.3
LearnPress WordPress Plugin before 4.4.6 contains a broken object-level authorization vulnerability that allows authenticated attackers with the Instructor role to add answers to quiz questions owned by other instructors by exploiting a missing ownership check on the question answer insert path. Attackers can supply arbitrary question identifiers during answer insertion, bypassing instructor-boundary restrictions to persistently modify quiz content across courses they do not own.
- Fixed in
- 4.4.6
- What to do
- Update the plugin to 4.4.6 or newer.
Full record and what to do →NVD recordwordpress.orgvulncheck.com
Jul 22, 2024MasterStudy LMS: Does not prevent students from creating instructor accountsCVE-2024-5973 · WordPress plugins & themes · reported by WPScanHigh 8.8
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.3.24 does not prevent students from creating instructor accounts, which could be used to get access to functionalities they shouldn't have.
- Product
- MasterStudy LMS
- Fixed in
- 3.3.24
- What to do
- Update MasterStudy LMS to 3.3.24 or newer.
Jul 30, 2021The LearnPress plugin before 3.2.6.9 for WordPress allows remote attackers to escalate the privileges of any user to LP Instructor via the accept-to-be-teacher CVE-2020-11511 · WordPress plugins & themes · reported by MITREHigh 8.1
The LearnPress plugin before 3.2.6.9 for WordPress allows remote attackers to escalate the privileges of any user to LP Instructor via the accept-to-be-teacher action parameter.
- Product
- LearnPress
- Fixed in
- 3.2.6.9
- What to do
- Update LearnPress to 3.2.6.9 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comcwe.mitre.org
Feb 4, 2020A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and performing other malCVE-2020-8615 · WordPress plugins & themes · reported by MITREMedium 6.5
A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and performing other malicious actions (such as blocking legitimate instructors).
- Product
- A CSRF vulnerability in the Tutor LMS
- Fixed in
- 1.5.3
- What to do
- Update A CSRF vulnerability in the Tutor LMS to 1.5.3 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpvulndb.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.