Vulnerability history

Instructor+ Stored XSS vulnerability

Unauthenticated Course Progress Disclosure and Deletion vulnerability

Instructor+ Stored XSS via Quiz Description vulnerability

WordPress Masteriyo - LMS plugin <= 2.3.2 - Arbitrary File Upload vulnerability

Unauthenticated Arbitrary User Session Termination (Denial of Service) vulnerability

WordPress Masteriyo - LMS plugin <= 2.3.1 - Insecure Direct Object References (IDOR) vulnerability

WordPress Masteriyo - LMS plugin <= 2.3.0 - Cross Site Scripting (XSS) vulnerability

Missing Authorization to Authenticated (Student+) Arbitrary Course Announcement Modification vulnerability

WordPress Masteriyo - LMS plugin <= 2.2.0 - Privilege Escalation vulnerability

WordPress Masteriyo - LMS plugin <= 2.1.8 - Broken Authentication vulnerability

WordPress Masteriyo - LMS plugin <= 2.1.5 - Payment Bypass vulnerability

Unauthenticated Authorization Bypass to Arbitrary Order Completion via Stripe Webhook Endpoint vulnerability

Missing Authorization to Authenticated (Student+) Privilege Escalation to Administrator vulnerability

WordPress Masteriyo - LMS plugin <= 2.0.3 - Sensitive Data Exposure vulnerability

WordPress Masteriyo - LMS Plugin plugin <= 1.18.3 - Cross Site Scripting (XSS) Vulnerability

Authenticated (Student+) Missing Authorization to Privilege Escalation vulnerability

Authenticated (Student+) Stored Cross-Site Scripting vulnerability

Insecure Direct Object Reference (IDOR) vulnerability

Broken Access Control vulnerability

Broken Access Control vulnerability

Broken Authentication vulnerability

Privilege Escalation vulnerability

Wordpress Masteriyo - LMS plugin <= 1.6.7 - Sensitive Information Exposure vulnerability