Vulnerability history

PHP Object Injection vulnerability

Broken Access Control vulnerability

Instructor+ Arbitrary User Display Name Update vulnerability

Cross Site Scripting (XSS) vulnerability

Subscriber+ Membership Plan Quota and Category Restriction Bypass vulnerability

Unauthenticated Account Creation with Registration Disabled vulnerability

Contributor+ LFI vulnerability

Subscriber+ Course and Lesson Creation vulnerability

Subscriber+ Lesson Completion Record Creation vulnerability

Subscriber+ Stored HTML Injection vulnerability

Subscriber+ Quiz Attempt Grade Disclosure vulnerability

Instructor+ Student PII Disclosure vulnerability

Instructor+ Order Status Manipulation vulnerability

Instructor+ Cross-Course Curriculum Deletion and Tampering vulnerability

Unauthenticated Student Statistics Disclosure vulnerability

Subscriber+ Cross-Instructor Order Data Disclosure vulnerability

Unauthenticated Student Enrollment Disclosure vulnerability

Instructor+ Quiz Answer Disclosure vulnerability

Unauthenticated Unpublished Course Title Disclosure vulnerability

Unauthenticated Payment Bypass vulnerability

Instructor+ Cross-Tenant Order Billing PII Disclosure vulnerability

Unauthenticated Open Redirect vulnerability

Arbitrary File Deletion vulnerability

Broken Access Control vulnerability

Privilege Escalation vulnerability

Broken Access Control vulnerability

Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Attachment Deletion vulnerability

Cross Site Scripting (XSS) vulnerability

Broken Access Control vulnerability

SQL Injection vulnerability

SQL Injection vulnerability

Authenticated (Subscriber+) Time-based Blind SQL Injection via 'order' and 'orderby' Parameters vulnerability

WordPress MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin <= 3.7.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'stm_lms_courses_grid_display' Shortcode vulnerability

for Online Courses and Education plugin <= 3.7.6 Missing Authorization to Authenticated (Subscriber+) Posts and Media Creation, Modification and Deletion vulnerability

SQL Injection vulnerability

Sensitive Data Exposure vulnerability

Broken Access Control Vulnerability

Race Condition Vulnerability

Broken Access Control vulnerability

Broken Access Control vulnerability

Local File Inclusion vulnerability

Privilege Escalation to Instructor vulnerability

Broken Access Control vulnerability

Cross Site Request Forgery (CSRF) vulnerability

Missing Authorization vulnerability

Unauthenticated Local File Inclusion via template vulnerability

Unauthenticated Privilege Escalation via stm_lms_register AJAX Action vulnerability

Unauthenticated Local File Inclusion via modal vulnerability

Missing Authorization to Sensitive Information Exposure in search_posts vulnerability

Basic Information Exposure via REST route vulnerability

Unauthenticated SQL Injection vulnerability

Unauthenticated Instructor Account Creation vulnerability

Reflected Cross Site Scripting (XSS) vulnerability

Cross Site Scripting (XSS) vulnerability

Broken Access Control vulnerability

Missing Authorization via wp_ajax_stm_wpcfto_get_settings vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Sensitive Information Disclosure vulnerability

Unauthenticated Admin Account Creation vulnerability