Stylemix MasterStudy LMS WordPress Plugin – for Online Courses and Education

• CVE-2026-5060 Medium 6.5 MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.14 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Attachment Deletion 0.4%
• CVE-2026-4817 Medium 6.5 MasterStudy LMS <= 3.7.25 - Authenticated (Subscriber+) Time-based Blind SQL Injection via 'order' and 'orderby' Parameters 0.5%
• CVE-2026-0559 Medium 6.4 MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'stm_lms_courses_grid_display' Shortcode 0.2%
• CVE-2025-13766 Medium 5.4 MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.6 Missing Authorization to Authenticated (Subscriber+) Posts and Media Creation, Modification and Deletion 0.2%
• CVE-2024-3942 Medium 6.3 MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.3.8 - Missing Authorization 0.4%
• CVE-2024-3136 Critical 9.8 MasterStudy LMS <= 3.3.3 - Unauthenticated Local File Inclusion via template 5.0%
• CVE-2024-1904 Medium 4.3 MasterStudy LMS <= 3.2.13 - Missing Authorization to Sensitive Information Exposure in search_posts 0.5%
• CVE-2024-2411 Critical 9.8 MasterStudy LMS <= 3.3.0 - Unauthenticated Local File Inclusion via modal 1.5%
• CVE-2024-2409 Critical 9.8 MasterStudy LMS <= 3.3.1 - Unauthenticated Privilege Escalation via stm_lms_register AJAX Action 0.8%
• CVE-2024-2106 Medium 5.3 MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.2.10 - Basic Information Exposure via REST route 0.8%
• CVE-2024-1512 Critical 9.8 MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.2.5 - Unauthenticated SQL Injection 77.7%