WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,007 vulnerabilities, 1,391 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,148 High 8,901 Medium 17,624 Low 328 Not scored 6

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 5, 2026.

Showing 1–34 of 34 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
4.2 Medium MasterStudy LMS 1.9 Plugin Broken Access Control < 3.7.50 - Subscriber+ Membership Plan Quota and Category Restriction Bypass 1.9 – < 3.7.50 Fixed in 3.7.50 CVE-2026-88848 WPScan
4.3 Medium MasterStudy LMS Plugin Broken Access Control Subscriber+ Lesson Completion Record Creation < 3.7.50 Fixed in 3.7.50 CVE-2026-88847 WPScan
5.3 Medium MasterStudy LMS 2.3.0 Plugin Broken Access Control < 3.7.50 - Unauthenticated Account Creation with Registration Disabled No login needed 2.3.0 – < 3.7.50 Fixed in 3.7.50 CVE-2026-88846 WPScan
4.3 Medium MasterStudy LMS 2.3.0 Plugin Broken Access Control < 3.7.50 - Subscriber+ Course and Lesson Creation via Demo Import 2.3.0 – < 3.7.50 Fixed in 3.7.50 CVE-2026-88845 WPScan
4.3 Medium MasterStudy LMS Plugin Information Disclosure Subscriber+ Quiz Attempt Grade Disclosure via IDOR < 3.7.50 Fixed in 3.7.50 CVE-2026-81339 WPScan
4.6 Medium MasterStudy LMS Plugin Content Injection Subscriber+ Stored HTML Injection via Course Discussions < 3.7.50 Fixed in 3.7.50 CVE-2026-81338 WPScan
5.3 Medium MasterStudy LMS Plugin Information Disclosure Unauthenticated Student Statistics Disclosure via student/stats REST Route No login needed < 3.7.46 Fixed in 3.7.46 CVE-2026-81199 WPScan
5.3 Medium MasterStudy LMS Plugin Information Disclosure Unauthenticated Unpublished Course Title Disclosure via course-list REST Route No login needed < 3.7.46 Fixed in 3.7.46 CVE-2026-81197 WPScan
5.3 Medium MasterStudy LMS Plugin Information Disclosure Unauthenticated Student Enrollment Disclosure via student-courses REST Route No login needed < 3.7.46 Fixed in 3.7.46 CVE-2026-81195 WPScan
4.3 Medium MasterStudy LMS Plugin Information Disclosure Subscriber+ Cross-Instructor Order Data Disclosure via author_id Parameter < 3.7.46 Fixed in 3.7.46 CVE-2026-81194 WPScan
4.7 Medium MasterStudy LMS Plugin Open Redirect Unauthenticated Open Redirect No login needed < 3.7.43 Fixed in 3.7.43 CVE-2026-81342 WPScan
4.8 Medium MasterStudy LMS Plugin Price Manipulation Unauthenticated Payment Bypass via PayPal IPN No login needed < 3.7.40 Fixed in 3.7.40 CVE-2026-81026 WPScan
6.5 Medium MasterStudy LMS Plugin masterstudy-lms-learning-management-system Broken Access Control ≤ 3.7.41 Fixed in 3.7.42 CVE-2026-73404 Patchstack
6.3 Medium MasterStudy LMS Plugin masterstudy-lms-learning-management-system Privilege Escalation ≤ 3.7.41 Fixed in 3.7.42 CVE-2026-68568 Patchstack
5.3 Medium MasterStudy LMS Plugin masterstudy-lms-learning-management-system Broken Access Control No login needed ≤ 3.7.39 Fixed in 3.7.40 CVE-2026-28145 Patchstack
6.5 Medium MasterStudy LMS WordPress Plugin – for Online Courses and Education Plugin masterstudy-lms-learning-management-system Broken Access Control for Online Courses and Education <= 3.7.14 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Attachment Deletion ≤ 3.7.23 CVE-2026-5060 Wordfence
6.5 Medium MasterStudy LMS Plugin masterstudy-lms-learning-management-system Cross-Site Scripting ≤ 3.7.27 Fixed in 3.7.28 CVE-2026-57330 Patchstack
4.3 Medium MasterStudy LMS Plugin masterstudy-lms-learning-management-system Broken Access Control ≤ 3.7.30 Fixed in 3.7.31 CVE-2026-57640 Patchstack
6.5 Medium MasterStudy LMS Pro Plugin masterstudy-lms-learning-management-system-pro Broken Access Control No login needed < 4.7.16 Fixed in 4.7.16 CVE-2025-64215 Patchstack
6.5 Medium MasterStudy LMS Pro Plus Plugin SQL Injection Authenticated (Instructor+) SQL Injection via 'columns' Parameter ≤ 4.8.20 CVE-2026-8653 Wordfence
6.5 Medium MasterStudy LMS Plugin masterstudy-lms-learning-management-system SQL Injection Authenticated (Subscriber+) Time-based Blind SQL Injection via 'order' and 'orderby' Parameters ≤ 3.7.25 CVE-2026-4817 Wordfence
6.4 Medium MasterStudy LMS WordPress Plugin – for Online Courses and Education Plugin masterstudy-lms-learning-management-system Cross-Site Scripting for Online Courses and Education <= 3.7.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'stm_lms_courses_grid_display' Shortcode ≤ 3.7.11 CVE-2026-0559 Wordfence
5.4 Medium MasterStudy LMS WordPress Plugin – for Online Courses and Education Plugin masterstudy-lms-learning-management-system Broken Access Control for Online Courses and Education <= 3.7.6 Missing Authorization to Authenticated (Subscriber+) Posts and Media Creation, Modification and Deletion ≤ 3.7.6 CVE-2025-13766 Wordfence
5.4 Medium MasterStudy LMS Pro Plugin masterstudy-lms-learning-management-system-pro Broken Access Control ≤ 4.7.16 Fixed in 4.7.16 CVE-2025-64212 Patchstack
4.9 Medium MasterStudy LMS Plugin masterstudy-lms-learning-management-system Information Disclosure Sensitive Data Exposure ≤ 3.6.20 Fixed in 3.6.21 CVE-2025-59575 Patchstack
6.5 Medium MasterStudy LMS Plugin masterstudy-lms-learning-management-system Broken Access Control ≤ 3.6.20 Fixed in 3.6.21 CVE-2025-59576 Patchstack
4.3 Medium MasterStudy LMS Plugin masterstudy-lms-learning-management-system Other Race Condition ≤ 3.6.20 Fixed in 3.6.21 CVE-2025-59577 Patchstack
6.5 Medium MasterStudy LMS Plugin masterstudy-lms-learning-management-system Broken Access Control ≤ 3.6.15 Fixed in 3.6.16 CVE-2025-54744 Patchstack
4.3 Medium MasterStudy LMS Plugin masterstudy-lms-learning-management-system Broken Access Control ≤ 3.5.28 Fixed in 3.5.29 CVE-2025-32237 Patchstack
4.3 Medium MasterStudy LMS Plugin masterstudy-lms-learning-management-system Cross-Site Request Forgery No login needed ≤ 3.2.1 Fixed in 3.2.2 CVE-2024-37093 Patchstack
5.3 Medium Masterstudy LMS Starter Theme Information Disclosure Sensitive Data Exposure No login needed ≤ 1.1.8 Fixed in 1.1.9 CVE-2024-43990 Patchstack
6.3 Medium MasterStudy LMS WordPress Plugin – for Online Courses and Education Plugin masterstudy-lms-learning-management-system Broken Access Control for Online Courses and Education <= 3.3.8 - Missing Authorization ≤ 3.3.8 CVE-2024-3942 Wordfence
4.3 Medium MasterStudy LMS Plugin masterstudy-lms-learning-management-system Broken Access Control Missing Authorization to Sensitive Information Exposure in search_posts ≤ 3.2.13 CVE-2024-1904 Wordfence
5.3 Medium MasterStudy LMS WordPress Plugin – for Online Courses and Education Plugin masterstudy-lms-learning-management-system Information Disclosure for Online Courses and Education <= 3.2.10 - Basic Information Exposure via REST route No login needed ≤ 3.2.10 CVE-2024-2106 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only