WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,007 vulnerabilities, 1,391 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,148 High 8,901 Medium 17,624 Low 328 Not scored 6

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 5, 2026.

Showing 1–50 of 64 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
4.3 Medium Masteriyo LMS Plugin learning-management-system Information Disclosure Subscriber+ Quiz Answer Key Disclosure < 3.4.2 Fixed in 3.4.2 CVE-2026-82850 WPScan
4.3 Medium Masteriyo LMS Plugin learning-management-system Information Disclosure Subscriber+ Arbitrary User Course Progress Disclosure via IDOR < 3.4.2 Fixed in 3.4.2 CVE-2026-82849 WPScan
2.7 Low Masteriyo LMS Plugin learning-management-system Information Disclosure Instructor+ Arbitrary Post Disclosure via IDOR 1.14.0 – < 3.4.1 Fixed in 3.4.1 CVE-2026-82851 WPScan
6.8 Medium Masteriyo LMS Plugin learning-management-system Cross-Site Scripting Instructor+ Stored XSS via Course Highlights < 3.4.1 Fixed in 3.4.1 CVE-2026-82847 WPScan
9.9 Critical Masteriyo LMS Plugin learning-management-system PHP Object Injection Subscriber+ PHP Object Injection < 3.4.1 Fixed in 3.4.1 CVE-2026-82845 WPScan
5.3 Medium Masteriyo - LMS Plugin learning-management-system Broken Access Control LMS plugin <= 3.4.0 - Broken Access Control No login needed ≤ 3.4.0 Fixed in 3.4.1 CVE-2026-62132 Patchstack
8.8 High Masteriyo - LMS Plugin learning-management-system PHP Object Injection LMS plugin <= 3.4.0 - PHP Object Injection ≤ 3.4.0 Fixed in 3.4.1 CVE-2026-62107 Patchstack
5.3 Medium Masteriyo LMS Plugin learning-management-system Information Disclosure Unauthenticated Course Enrollment Disclosure No login needed 1.3.1 – < 3.4.0 Fixed in 3.4.0 CVE-2026-82848 WPScan
5.3 Medium Masteriyo LMS Plugin learning-management-system Broken Access Control Missing Authorization to Unauthenticated Arbitrary Course Progress Deletion No login needed ≤ 2.2.0 CVE-2026-8279 Wordfence
6.8 Medium Masteriyo LMS Plugin learning-management-system Cross-Site Scripting Instructor+ Stored XSS via Course Custom Fields 1.18.0 – < 3.4.0 Fixed in 3.4.0 CVE-2026-82846 WPScan
8.6 High MasterStudy LMS Plugin masterstudy-lms-learning-management-system Arbitrary File Deletion No login needed ≤ 3.7.42 Fixed in 3.7.43 CVE-2026-78284 Patchstack
9.8 Critical Masteriyo - LMS Plugin learning-management-system Arbitrary File Upload LMS plugin <= 2.3.2 - Arbitrary File Upload No login needed ≤ 2.3.2 Fixed in 2.3.3 CVE-2026-73996 Patchstack
6.5 Medium MasterStudy LMS Plugin masterstudy-lms-learning-management-system Broken Access Control ≤ 3.7.41 Fixed in 3.7.42 CVE-2026-73404 Patchstack
6.3 Medium MasterStudy LMS Plugin masterstudy-lms-learning-management-system Privilege Escalation ≤ 3.7.41 Fixed in 3.7.42 CVE-2026-68568 Patchstack
6.1 Medium Masteriyo LMS Plugin learning-management-system Cross-Site Scripting Instructor+ Stored XSS via Quiz Description No login needed < 2.3.3 Fixed in 2.3.3 CVE-2026-19712 WPScan
5.3 Medium MasterStudy LMS Plugin masterstudy-lms-learning-management-system Broken Access Control No login needed ≤ 3.7.39 Fixed in 3.7.40 CVE-2026-28145 Patchstack
6.5 Medium MasterStudy LMS WordPress Plugin – for Online Courses and Education Plugin masterstudy-lms-learning-management-system Broken Access Control for Online Courses and Education <= 3.7.14 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Attachment Deletion ≤ 3.7.23 CVE-2026-5060 Wordfence
9.1 Critical Masteriyo LMS Plugin learning-management-system Denial of Service Unauthenticated Arbitrary User Session Termination (Denial of Service) No login needed < 2.3.1 Fixed in 2.3.1 CVE-2026-13332 WPScan
5.4 Medium Masteriyo - LMS Plugin learning-management-system Broken Access Control LMS plugin <= 2.3.1 - Insecure Direct Object References (IDOR) ≤ 2.3.1 Fixed in 2.3.2 CVE-2026-65463 Patchstack
6.5 Medium Masteriyo - LMS Plugin learning-management-system Cross-Site Scripting LMS plugin <= 2.3.0 - Cross Site Scripting (XSS) ≤ 2.3.0 Fixed in 2.3.1 CVE-2026-59513 Patchstack
6.5 Medium MasterStudy LMS Plugin masterstudy-lms-learning-management-system Cross-Site Scripting ≤ 3.7.27 Fixed in 3.7.28 CVE-2026-57330 Patchstack
4.3 Medium Masteriyo LMS Plugin learning-management-system Broken Access Control Missing Authorization to Authenticated (Student+) Arbitrary Course Announcement Modification ≤ 2.2.1 CVE-2026-11773 Wordfence
4.3 Medium MasterStudy LMS Plugin masterstudy-lms-learning-management-system Broken Access Control ≤ 3.7.30 Fixed in 3.7.31 CVE-2026-57640 Patchstack
6.5 Medium Masteriyo LMS Plugin learning-management-system Information Disclosure Unauthenticated Course Progress Disclosure and Deletion No login needed < 2.2.1 Fixed in 2.2.1 CVE-2026-10824 WPScan
6.5 Medium Masteriyo - LMS Plugin learning-management-system Authentication Bypass LMS plugin <= 2.1.8 - Broken Authentication No login needed ≤ 2.1.8 Fixed in 2.1.9 CVE-2026-42743 Patchstack
8.5 High MasterStudy LMS Plugin masterstudy-lms-learning-management-system SQL Injection ≤ 3.7.25 Fixed in 3.7.26 CVE-2026-40766 Patchstack
7.5 High Masteriyo - LMS Plugin learning-management-system Price Manipulation LMS plugin <= 2.1.5 - Payment Bypass No login needed ≤ 2.1.5 Fixed in 2.1.6 CVE-2026-39524 Patchstack
6.5 Medium MasterStudy LMS Pro Plugin masterstudy-lms-learning-management-system-pro Broken Access Control No login needed < 4.7.16 Fixed in 4.7.16 CVE-2025-64215 Patchstack
8.8 High Masteriyo - LMS Plugin learning-management-system Privilege Escalation LMS plugin <= 2.2.0 - Privilege Escalation ≤ 2.2.0 Fixed in 2.2.1 CVE-2026-49111 Patchstack
9.8 Critical Masteriyo LMS PRO Plugin learning-management-system-pro Privilege Escalation No login needed ≤ 2.20.0 Fixed in 2.20.1 CVE-2025-53209 Patchstack
8.5 High MasterStudy LMS Plugin masterstudy-lms-learning-management-system SQL Injection ≤ 3.7.29 Fixed in 3.7.30 CVE-2026-42730 Patchstack
6.5 Medium MasterStudy LMS Plugin masterstudy-lms-learning-management-system SQL Injection Authenticated (Subscriber+) Time-based Blind SQL Injection via 'order' and 'orderby' Parameters ≤ 3.7.25 CVE-2026-4817 Wordfence
5.3 Medium Masteriyo LMS Plugin learning-management-system Broken Access Control Unauthenticated Authorization Bypass to Arbitrary Order Completion via Stripe Webhook Endpoint No login needed ≤ 2.1.7 CVE-2026-5167 Wordfence
8.8 High Masteriyo LMS Plugin learning-management-system Broken Access Control Missing Authorization to Authenticated (Student+) Privilege Escalation to Administrator ≤ 2.1.6 CVE-2026-4484 Wordfence
6.4 Medium MasterStudy LMS WordPress Plugin – for Online Courses and Education Plugin masterstudy-lms-learning-management-system Cross-Site Scripting for Online Courses and Education <= 3.7.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'stm_lms_courses_grid_display' Shortcode ≤ 3.7.11 CVE-2026-0559 Wordfence
5.4 Medium MasterStudy LMS WordPress Plugin – for Online Courses and Education Plugin masterstudy-lms-learning-management-system Broken Access Control for Online Courses and Education <= 3.7.6 Missing Authorization to Authenticated (Subscriber+) Posts and Media Creation, Modification and Deletion ≤ 3.7.6 CVE-2025-13766 Wordfence
6.5 Medium Masteriyo - LMS Plugin learning-management-system Information Disclosure LMS plugin <= 2.0.3 - Sensitive Data Exposure ≤ 2.0.3 Fixed in 2.0.4 CVE-2025-64270 Patchstack
7.5 High MasterStudy LMS Pro Plugin masterstudy-lms-learning-management-system-pro Broken Access Control Arbitrary Content Deletion No login needed ≤ 4.7.16 Fixed in 4.7.16 CVE-2025-64214 Patchstack
7.5 High MasterStudy LMS Pro Plugin masterstudy-lms-learning-management-system-pro Information Disclosure Sensitive Data Exposure No login needed ≤ 4.7.16 Fixed in 4.7.16 CVE-2025-64213 Patchstack
7.6 High MasterStudy LMS Plugin masterstudy-lms-learning-management-system SQL Injection ≤ 3.6.27 Fixed in 3.6.28 CVE-2025-64366 Patchstack
5.4 Medium MasterStudy LMS Pro Plugin masterstudy-lms-learning-management-system-pro Broken Access Control ≤ 4.7.16 Fixed in 4.7.16 CVE-2025-64212 Patchstack
4.9 Medium MasterStudy LMS Plugin masterstudy-lms-learning-management-system Information Disclosure Sensitive Data Exposure ≤ 3.6.20 Fixed in 3.6.21 CVE-2025-59575 Patchstack
6.5 Medium MasterStudy LMS Plugin masterstudy-lms-learning-management-system Broken Access Control ≤ 3.6.20 Fixed in 3.6.21 CVE-2025-59576 Patchstack
4.3 Medium MasterStudy LMS Plugin masterstudy-lms-learning-management-system Other Race Condition ≤ 3.6.20 Fixed in 3.6.21 CVE-2025-59577 Patchstack
6.5 Medium MasterStudy LMS Plugin masterstudy-lms-learning-management-system Broken Access Control ≤ 3.6.15 Fixed in 3.6.16 CVE-2025-54744 Patchstack
6.5 Medium Masteriyo - LMS Plugin learning-management-system Cross-Site Scripting LMS Plugin plugin <= 1.18.3 - Cross Site Scripting (XSS) ≤ 1.18.3 Fixed in 1.18.4 CVE-2025-54699 Patchstack
5.3 Medium Masteriyo - LMS Plugin learning-management-system Authentication Bypass Broken Authentication No login needed ≤ 1.7.3 Fixed in 1.7.4 CVE-2024-33939 Patchstack
4.3 Medium MasterStudy LMS Plugin masterstudy-lms-learning-management-system Broken Access Control ≤ 3.5.28 Fixed in 3.5.29 CVE-2025-32237 Patchstack
8.8 High MasterStudy LMS Plugin masterstudy-lms-learning-management-system Local File Inclusion ≤ 3.5.28 Fixed in 3.5.29 CVE-2025-32141 Patchstack
4.3 Medium MasterStudy LMS Plugin masterstudy-lms-learning-management-system Cross-Site Request Forgery No login needed ≤ 3.2.1 Fixed in 3.2.2 CVE-2024-37093 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only