Masteriyo LMS – LMS Course Builder, Quizzes & Certificates

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Masteriyo LMS – LMS Course Builder, Quizzes & Certificates

Information

Software Type Plugin
Software Slug learning-management-system (view on wordpress.org)
Software Status Active
Software Author masteriyo
Software Website masteriyo.com
Software Downloads 321,546
Software Active Installs 6,000
Software Record Last Updated October 10, 2026

Showing 1-20 of 32 Vulnerabilities

Submit a Vulnerability
Masteriyo LMS <= 3.4.1 - Authenticated (Subscriber+) Information Exposure
4.3
CVE-2026-82850
Sep 22, 2026
Researcher: Usama Arshad
Masteriyo LMS <= 3.4.1 - Authenticated (Subscriber+) Insecure Direct Object Reference
4.3
CVE-2026-82849
Sep 22, 2026
Researcher: Karthik Ramakrishnan
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates 1.14.0 - 3.4.0 - Authenticated (Custom Role+) Insecure Direct Object Reference
4.3
CVE-2026-82851
Sep 12, 2026
Researcher: Karthik Ramakrishnan
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates < 3.4.1 - Authenticated (Custom Role+) Stored Cross-Site Scripting
6.4
CVE-2026-82847
Sep 12, 2026
Researcher: Karthik Ramakrishnan
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates <= 3.4.0 - Unauthenticated PHP Object Injection
8.1
CVE-2026-62107
Sep 11, 2026
Researcher: 20kilograma
Masteriyo LMS <= 3.4.0 - Authenticated (Subscriber+) PHP Object Injection
7.5
CVE-2026-82845
Sep 10, 2026
Researcher: Karthik Ramakrishnan
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates <= 3.4.0 - Missing Authorization
4.3
CVE-2026-62132
Sep 10, 2026
Researcher: MYUNGYONG LEE
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates 1.3.1 - 2.3.3 - Unauthenticated Information Exposure
5.3
CVE-2026-82848
Sep 9, 2026
Researcher: Karthik Ramakrishnan
Masteriyo LMS <= 2.2.0 - Missing Authorization to Unauthenticated Arbitrary Course Progress Deletion
5.3
CVE-2026-8279
Sep 6, 2026
Researcher: Jamshed Yergashvoyev (CVE Guy)
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates 1.18.0 - 2.3.3 - Authenticated (Custom Role+) Stored Cross-Site Scripting
6.4
CVE-2026-82846
Sep 5, 2026
Researcher: Mutantgun
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates < 2.3.3 - Authenticated (Custom Role+) Stored Cross-Site Scripting
6.4
CVE-2026-19712
Aug 20, 2026
Researcher: Farid Narimanov
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates <= 2.3.2 - Unauthenticated Arbitrary File Upload
9.8
CVE-2026-73996
Aug 18, 2026
Researcher: 20kilograma
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates <= 2.3.1 - Authenticated (Subscriber+) Insecure Direct Object Reference
4.3
CVE-2026-65463
Jul 22, 2026
Researcher: Celvex Group
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates <= 2.3.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVE-2026-59513
Jul 21, 2026
Researchers:
Masteriyo LMS <= 2.3.0 - Missing Authorization to Unauthenticated User Session Termination
5.3
CVE-2026-13332
Jul 6, 2026
Researcher: Nakata Christian
Masteriyo LMS <= 2.2.1 - Missing Authorization to Authenticated (Student+) Arbitrary Course Announcement Modification
4.3
CVE-2026-11773
Jun 26, 2026
Researcher: ilinor
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates <= 2.2.0 - Authenticated (Subscriber+) Privilege Escalation
8.8
CVE-2026-49111
Jun 8, 2026
Researcher: daroo
Masteriyo LMS <= 2.2.0 - Missing Authorization to Unauthenticated Course Progress Disclosure and Deletion
5.3
CVE-2026-10824
Jun 4, 2026
Researcher: Muni Nitish Kumar Yaddala
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates <= 2.1.8 - Missing Authorization
5.3
CVE-2026-42743
May 28, 2026
Researcher: HieuPenguin
Masteriyo LMS – Online Course Builder for eLearning, LMS & Education <= 2.1.5 - Missing Authorization
5.3
CVE-2026-39524
Apr 8, 2026
Researcher: davidfdzmorilla
Title Status CVE ID CVSS Researchers Date
Masteriyo LMS <= 3.4.1 - Authenticated (Subscriber+) Information Exposure Patched CVE-2026-82850 4.3 Usama Arshad September 22, 2026
Masteriyo LMS <= 3.4.1 - Authenticated (Subscriber+) Insecure Direct Object Reference Patched CVE-2026-82849 4.3 Karthik Ramakrishnan September 22, 2026
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates 1.14.0 - 3.4.0 - Authenticated (Custom Role+) Insecure Direct Object Reference Patched CVE-2026-82851 4.3 Karthik Ramakrishnan September 12, 2026
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates < 3.4.1 - Authenticated (Custom Role+) Stored Cross-Site Scripting Patched CVE-2026-82847 6.4 Karthik Ramakrishnan September 12, 2026
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates <= 3.4.0 - Unauthenticated PHP Object Injection Patched CVE-2026-62107 8.1 20kilograma September 11, 2026
Masteriyo LMS <= 3.4.0 - Authenticated (Subscriber+) PHP Object Injection Patched CVE-2026-82845 7.5 Karthik Ramakrishnan September 10, 2026
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates <= 3.4.0 - Missing Authorization Patched CVE-2026-62132 4.3 MYUNGYONG LEE September 10, 2026
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates 1.3.1 - 2.3.3 - Unauthenticated Information Exposure Patched CVE-2026-82848 5.3 Karthik Ramakrishnan September 9, 2026
Masteriyo LMS <= 2.2.0 - Missing Authorization to Unauthenticated Arbitrary Course Progress Deletion Patched CVE-2026-8279 5.3 Jamshed Yergashvoyev (CVE Guy) September 6, 2026
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates 1.18.0 - 2.3.3 - Authenticated (Custom Role+) Stored Cross-Site Scripting Patched CVE-2026-82846 6.4 Mutantgun September 5, 2026
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates < 2.3.3 - Authenticated (Custom Role+) Stored Cross-Site Scripting Patched CVE-2026-19712 6.4 Farid Narimanov August 20, 2026
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates <= 2.3.2 - Unauthenticated Arbitrary File Upload Patched CVE-2026-73996 9.8 20kilograma August 18, 2026
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates <= 2.3.1 - Authenticated (Subscriber+) Insecure Direct Object Reference Patched CVE-2026-65463 4.3 Celvex Group July 22, 2026
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates <= 2.3.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting Patched CVE-2026-59513 6.4 July 21, 2026
Masteriyo LMS <= 2.3.0 - Missing Authorization to Unauthenticated User Session Termination Patched CVE-2026-13332 5.3 Nakata Christian July 6, 2026
Masteriyo LMS <= 2.2.1 - Missing Authorization to Authenticated (Student+) Arbitrary Course Announcement Modification Patched CVE-2026-11773 4.3 ilinor June 26, 2026
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates <= 2.2.0 - Authenticated (Subscriber+) Privilege Escalation Patched CVE-2026-49111 8.8 daroo June 8, 2026
Masteriyo LMS <= 2.2.0 - Missing Authorization to Unauthenticated Course Progress Disclosure and Deletion Patched CVE-2026-10824 5.3 Muni Nitish Kumar Yaddala June 4, 2026
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates <= 2.1.8 - Missing Authorization Patched CVE-2026-42743 5.3 HieuPenguin May 28, 2026
Masteriyo LMS – Online Course Builder for eLearning, LMS & Education <= 2.1.5 - Missing Authorization Patched CVE-2026-39524 5.3 davidfdzmorilla April 8, 2026

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation