MasterStudy LMS WordPress Plugin – for Online Courses and Education

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   MasterStudy LMS WordPress Plugin – for Online Courses and Education

Information

Software Type Plugin
Software Slug masterstudy-lms-learning-management-system (view on wordpress.org)
Software Status Active
Software Author stylemix
Software Website masterstudy.stylemixthemes.com
Software Downloads 1,961,331
Software Active Installs 10,000
Software Record Last Updated July 13, 2026

Showing 1-20 of 30 Vulnerabilities

Submit a Vulnerability
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.27 - Authenticated (Subscriber+) Stored Cross-Site Scripting
6.4
CVE-2026-57330
Jun 29, 2026
Researcher: endy
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.30 - Missing Authorization
4.3
CVE-2026-57640
Jun 26, 2026
Researcher: lagi bljr
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.29 - Authenticated (Subscriber+) SQL Injection
6.5
CVE-2026-42730
May 24, 2026
Researcher: walow
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.25 - Authenticated (Subscriber+) SQL Injection
6.5
CVE-2026-40766
Apr 21, 2026
Researcher: Jakub Herman
MasterStudy LMS <= 3.7.25 - Authenticated (Subscriber+) Time-based Blind SQL Injection via 'order' and 'orderby' Parameters
6.5
CVE-2026-4817
Apr 16, 2026
Researcher: Naoya Takahashi (nakko)
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'stm_lms_courses_grid_display' Shortcode
6.4
CVE-2026-0559
Feb 13, 2026
Researcher: Muhammad Yudha - DJ
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.6 Missing Authorization to Authenticated (Subscriber+) Posts and Media Creation, Modification and Deletion
5.4
CVE-2025-13766
Jan 5, 2026
Researcher: thinnawarth mathuros
MasterStudy LMS <= 3.6.27 - Authenticated (Instructor+) SQL Injection
6.5
CVE-2025-64366
Oct 23, 2025
Researcher: YC_Infosec
MasterStudy LMS <= 3.6.20 - Authenticated (Instructor+) Sensitive Information Exposure
4.3
CVE-2025-59575
Oct 16, 2025
Researcher: Bibek Dhakal
MasterStudy LMS <= 3.6.20 - Missing Authorization
4.3
CVE-2025-59576
Sep 22, 2025
Researcher: Bibek Dhakal
MasterStudy LMS <= 3.6.20 - Authenticated (Subscriber+) Race Condition to Multiple Reviews
4.3
CVE-2025-59577
Sep 22, 2025
Researcher: Bibek Dhakal
MasterStudy LMS <= 3.6.15 - Missing Authorization
4.3
CVE-2025-54744
Sep 3, 2025
Researcher: 0xd4rk5id3
MasterStudy LMS <= 3.5.28 - Authenticated (Contributor+) Local File Inclusion
8.8
CVE-2025-32141
Apr 4, 2025
Researcher: LVT-tholv2k
MasterStudy LMS <= 3.5.28 - Missing Authorization
4.3
CVE-2025-32237
Apr 4, 2025
Researcher: Kévin Mosbahi (Mika)
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.3.23 - Unauthenticated Limited Privilege Escalation to Instructor
7.3
CVE-2024-5973
Jul 1, 2024
Researcher: Jaime F. Murillo
MasterStudy LMS <= 3.2.1 - Cross-Site Request Forgery
4.3
CVE-2024-37093
Jun 20, 2024
Researcher: Majed Refaea
MasterStudy LMS <= 3.2.12 - Missing Authorization
5.3
CVE-2024-37094
Jun 20, 2024
Researcher: Majed Refaea
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.3.8 - Missing Authorization
6.3
CVE-2024-3942
Apr 29, 2024
Researcher: Lucio Sá
MasterStudy LMS <= 3.3.3 - Unauthenticated Local File Inclusion via template
9.8
CVE-2024-3136
Apr 4, 2024
Researcher: Hiroho Shimada
MasterStudy LMS <= 3.3.0 - Unauthenticated Local File Inclusion via modal
9.8
CVE-2024-2411
Mar 28, 2024
Researcher: Hiroho Shimada
Title Status CVE ID CVSS Researchers Date
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.27 - Authenticated (Subscriber+) Stored Cross-Site Scripting Patched CVE-2026-57330 6.4 endy June 29, 2026
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.30 - Missing Authorization Patched CVE-2026-57640 4.3 lagi bljr June 26, 2026
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.29 - Authenticated (Subscriber+) SQL Injection Patched CVE-2026-42730 6.5 walow May 24, 2026
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.25 - Authenticated (Subscriber+) SQL Injection Patched CVE-2026-40766 6.5 Jakub Herman April 21, 2026
MasterStudy LMS <= 3.7.25 - Authenticated (Subscriber+) Time-based Blind SQL Injection via 'order' and 'orderby' Parameters Patched CVE-2026-4817 6.5 Naoya Takahashi (nakko) April 16, 2026
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'stm_lms_courses_grid_display' Shortcode Patched CVE-2026-0559 6.4 Muhammad Yudha - DJ February 13, 2026
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.6 Missing Authorization to Authenticated (Subscriber+) Posts and Media Creation, Modification and Deletion Patched CVE-2025-13766 5.4 thinnawarth mathuros January 5, 2026
MasterStudy LMS <= 3.6.27 - Authenticated (Instructor+) SQL Injection Patched CVE-2025-64366 6.5 YC_Infosec October 23, 2025
MasterStudy LMS <= 3.6.20 - Authenticated (Instructor+) Sensitive Information Exposure Patched CVE-2025-59575 4.3 Bibek Dhakal October 16, 2025
MasterStudy LMS <= 3.6.20 - Missing Authorization Patched CVE-2025-59576 4.3 Bibek Dhakal September 22, 2025
MasterStudy LMS <= 3.6.20 - Authenticated (Subscriber+) Race Condition to Multiple Reviews Patched CVE-2025-59577 4.3 Bibek Dhakal September 22, 2025
MasterStudy LMS <= 3.6.15 - Missing Authorization Patched CVE-2025-54744 4.3 0xd4rk5id3 September 3, 2025
MasterStudy LMS <= 3.5.28 - Authenticated (Contributor+) Local File Inclusion Patched CVE-2025-32141 8.8 LVT-tholv2k April 4, 2025
MasterStudy LMS <= 3.5.28 - Missing Authorization Patched CVE-2025-32237 4.3 Kévin Mosbahi (Mika) April 4, 2025
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.3.23 - Unauthenticated Limited Privilege Escalation to Instructor Patched CVE-2024-5973 7.3 Jaime F. Murillo July 1, 2024
MasterStudy LMS <= 3.2.1 - Cross-Site Request Forgery Patched CVE-2024-37093 4.3 Majed Refaea June 20, 2024
MasterStudy LMS <= 3.2.12 - Missing Authorization Patched CVE-2024-37094 5.3 Majed Refaea June 20, 2024
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.3.8 - Missing Authorization Patched CVE-2024-3942 6.3 Lucio Sá April 29, 2024
MasterStudy LMS <= 3.3.3 - Unauthenticated Local File Inclusion via template Patched CVE-2024-3136 9.8 Hiroho Shimada April 4, 2024
MasterStudy LMS <= 3.3.0 - Unauthenticated Local File Inclusion via modal Patched CVE-2024-2411 9.8 Hiroho Shimada March 28, 2024

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation