MasterStudy LMS
Stylemix
Developer
3.7.48
Latest version
10,000
Installations
No date
Last updated
Vulnerability history
0 present
46 patched
22 Mitigation rules
- Instructor+ Cross-Course Curriculum Deletion and Tampering vulnerability< 3.7.465 days ago
- Unauthenticated Student Statistics Disclosure vulnerability< 3.7.465 days ago
- Subscriber+ Cross-Instructor Order Data Disclosure vulnerability< 3.7.465 days ago
- Unauthenticated Student Enrollment Disclosure vulnerability< 3.7.465 days ago
- Instructor+ Quiz Answer Disclosure vulnerability< 3.7.465 days ago
- Unauthenticated Unpublished Course Title Disclosure vulnerability< 3.7.465 days ago
- Unauthenticated Payment Bypass vulnerability< 3.7.4029/08/2026
- Instructor+ Cross-Tenant Order Billing PII Disclosure vulnerability< 3.7.4229/08/2026
- Unauthenticated Open Redirect vulnerability< 3.7.4329/08/2026
- Arbitrary File Deletion vulnerability<= 3.7.4224/08/2026
- Broken Access Control vulnerability<= 3.7.4118/08/2026
- Privilege Escalation vulnerability<= 3.7.4118/08/2026
- Broken Access Control vulnerability<= 3.7.3931/07/2026
- Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Attachment Deletion vulnerability<= 3.7.2328/07/2026
- Cross Site Scripting (XSS) vulnerability<= 3.7.2729/06/2026
- Broken Access Control vulnerability<= 3.7.3026/06/2026
- SQL Injection vulnerability<= 3.7.2924/05/2026
- SQL Injection vulnerability<= 3.7.2521/04/2026
- Authenticated (Subscriber+) Time-based Blind SQL Injection via 'order' and 'orderby' Parameters vulnerability<= 3.7.2517/04/2026
- WordPress MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin <= 3.7.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'stm_lms_courses_grid_display' Shortcode vulnerability<= 3.7.1113/02/2026
- for Online Courses and Education plugin <= 3.7.6 Missing Authorization to Authenticated (Subscriber+) Posts and Media Creation, Modification and Deletion vulnerability<= 3.7.605/01/2026
- SQL Injection vulnerability<= 3.6.2715/11/2025
- Sensitive Data Exposure vulnerability<= 3.6.2016/10/2025
- Broken Access Control Vulnerability<= 3.6.2022/09/2025
- Race Condition Vulnerability<= 3.6.2022/09/2025
- Broken Access Control vulnerability<= 3.6.1503/09/2025
- Broken Access Control vulnerability<= 3.5.2804/04/2025
- Local File Inclusion vulnerability<= 3.5.2804/04/2025
- Privilege Escalation to Instructor vulnerability< 3.3.2422/07/2024
- Broken Access Control vulnerability<= 3.2.1220/06/2024
- Cross Site Request Forgery (CSRF) vulnerability<= 3.2.120/06/2024
- Missing Authorization vulnerability<= 3.3.830/04/2024
- Unauthenticated Local File Inclusion via template vulnerability<= 3.3.305/04/2024
- Unauthenticated Privilege Escalation via stm_lms_register AJAX Action vulnerability<= 3.3.101/04/2024
- Unauthenticated Local File Inclusion via modal vulnerability<= 3.3.001/04/2024
- Missing Authorization to Sensitive Information Exposure in search_posts vulnerability<= 3.2.1318/03/2024
- Basic Information Exposure via REST route vulnerability<= 3.2.1007/03/2024
- Unauthenticated SQL Injection vulnerability<= 3.2.519/02/2024
- Unauthenticated Instructor Account Creation vulnerability< 3.0.1812/09/2023
- Reflected Cross Site Scripting (XSS) vulnerability<= 2.7.919/07/2023
- Cross Site Scripting (XSS) vulnerability<= 3.0.815/06/2023
- Broken Access Control vulnerability<= 3.0.815/06/2023
- Missing Authorization via wp_ajax_stm_wpcfto_get_settings vulnerability<= 2.9.3404/04/2023
- Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability< 2.8.028/02/2022
- Sensitive Information Disclosure vulnerability< 2.8.028/02/2022
- Unauthenticated Admin Account Creation vulnerability<= 2.7.501/02/2022