Masterstudy Lms Wordpress Plugin
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:masterstudy_lms_wordpress_plugin:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Masterstudy Lms Wordpress Plugin (efca642d-589a-5027-a977-92e44c95bf1f) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-88849 |
vulnerable | 2026-11-03 10:17:49.243241 |
MasterStudy LMS 3.7.13 - 3.7.54 - Instructor+ Arbitrary User Display Name Update via Student Enrollment
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.55 does not verify that a user targeted through its student-enrolment feature has any relationship to the requesting instructor, allowing users with the Instructor role to overwrite the first name, last name and public display name of any registered user on the site, including administrators, enabling impersonation and phishing.
Published: 2026-10-22T06:00:18.654Z
Updated: 2026-10-22T11:06:28.498Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-88844 |
vulnerable | 2026-10-13 12:29:54.669921 |
MasterStudy LMS 3.6.2 - < 3.7.50 - Instructor+ Student PII Disclosure via IDOR
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that the requesting user owns the course before returning its enrolled-student data, allowing users with the MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50's Instructor role to disclose the names and email addresses of students enrolled in other instructors' courses.
Published: 2026-09-18T06:00:16.075Z
Updated: 2026-09-18T11:08:43.091Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-81338 |
vulnerable | 2026-10-13 12:28:37.166273 |
MasterStudy LMS < 3.7.50 - Subscriber+ Stored HTML Injection via Course Discussions
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not properly sanitise and restrict HTML in user-submitted content before storing it and rendering it to other users, allowing users with subscriber-level accounts and above to perform stored HTML injection, such as embedding iframes, that can be leveraged for phishing and content spoofing against other users viewing the content.
Published: 2026-09-23T06:00:15.761Z
Updated: 2026-09-23T10:59:21.227Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-81339 |
vulnerable | 2026-10-13 12:28:36.964686 |
MasterStudy LMS < 3.7.50 - Subscriber+ Quiz Attempt Grade Disclosure via IDOR
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform a per-object ownership check when returning a quiz attempt result, allowing any authenticated user with a minimal (subscriber) role to read other students' quiz grades, pass/fail status and attempt timestamps by referencing an attempt identifier belonging to another user.
Published: 2026-09-23T06:00:15.932Z
Updated: 2026-09-23T10:59:07.298Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-81340 |
vulnerable | 2026-10-13 12:28:36.758418 |
MasterStudy LMS < 3.7.50 - Instructor+ Order Status Manipulation via IDOR
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating orders through its REST API, allowing users with the Instructor role to modify any order on the site, granting free course enrolment, revoking other users' paid enrolments, and tampering with order notes.
Published: 2026-09-18T06:00:11.903Z
Updated: 2026-09-18T11:13:38.917Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-5973 |
vulnerable | 2026-06-08 06:56:18.112603 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-4278 |
vulnerable | 2026-06-08 06:16:11.975800 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.