Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-78284 | 8.6 high | 1.0% | no CPE yet | Unauthenticated Arbitrary File Deletion in MasterStudy LMS <= 3.7.42 versions. | 12 Oct |
| CVE-2026-42730 | 8.5 high | 0.00% | no CPE yet | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Blind SQL Injection.This issue affects MasterStudy LMS: from n/a through <= 3.7.29. | Mon 26 Oct |
| CVE-2026-40766 | 8.5 high | 0.00% | no CPE yet | Subscriber SQL Injection in MasterStudy LMS <= 3.7.25 versions. | Sun 25 Oct |
| CVE-2025-64213 | 7.5 high | 0.00% | no CPE yet | Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes MasterStudy LMS Pro masterstudy-lms-learning-management-system-pro allows Retrieve Embedded Sensitive Data.This issue affects MasterStudy LMS Pro: from n/a through < 4.7.16. | Fri 23 Oct |
| CVE-2026-57330 | 6.5 medium | 0.00% | no CPE yet | Subscriber Cross Site Scripting (XSS) in MasterStudy LMS <= 3.7.27 versions. | Sun 25 Oct |
| CVE-2026-73404 | 6.5 medium | 0.00% | no CPE yet | Subscriber Broken Access Control in MasterStudy LMS <= 3.7.41 versions. | 22 Oct |
| CVE-2025-59576 | 6.5 medium | 0.00% | no CPE yet | Missing Authorization vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MasterStudy LMS: from n/a through <= 3.6.20. | 11 Oct |
| CVE-2026-105079 | 6.5 medium | 0.00% | no CPE yet | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-management-system allows Stored XSS.This issue affects MasterStudy LMS: from n/a through 3.7.52. | 10 Oct |
| CVE-2026-68568 | 6.3 medium | 0.00% | no CPE yet | Subscriber Privilege Escalation in MasterStudy LMS <= 3.7.41 versions. | 22 Oct |
| CVE-2025-64212 | 5.4 medium | 0.00% | no CPE yet | Missing Authorization vulnerability in StylemixThemes MasterStudy LMS Pro masterstudy-lms-learning-management-system-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MasterStudy LMS Pro: from n/a through < 4.7.16. | Fri 23 Oct |
| CVE-2026-80067 | 5.3 medium | — | stylemix, masterstudy lms wordpress plugin | MasterStudy LMS plugin for WordPress before 3.7.50 contains a path traversal vulnerability that allows authenticated Subscriber-level users to import arbitrary WXR XML files by supplying directory traversal sequences in the stm_lms_step parameter passed to the stm_lms_import_sample_data AJAX action, which lacks capability checks and nonce verification. Attackers can traverse the file system to reference a reachable WXR file and have the handler publish its contained posts under their identity, enabling publication of attacker-chosen post type, title, content, and metadata. | Thu 29 Oct |
| CVE-2026-80069 | 5.3 medium | — | stylemix, masterstudy lms wordpress plugin | MasterStudy LMS plugin for WordPress before 3.7.50 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to trigger the stm_lms_send_test_email_ajax AJAX action without capability or nonce validation. Attackers can invoke this handler directly or via cross-site request forgery to cause an uncaught PHP fatal error that, when display_errors is enabled, discloses the absolute filesystem path of the plugin. | Thu 29 Oct |
| CVE-2026-28145 | 5.3 medium | 0.00% | no CPE yet | Insufficient Verification of Data Authenticity vulnerability in StylemixThemes MasterStudy LMS allows Manipulating User State. This issue affects MasterStudy LMS: from n/a through 3.7.39. | Fri 23 Oct |
| CVE-2025-59575 | 4.9 medium | 0.00% | no CPE yet | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Retrieve Embedded Sensitive Data.This issue affects MasterStudy LMS: from n/a through <= 3.6.20. | 8 Oct |
| CVE-2026-118092 | 4.3 medium | — | stylemixthemes, masterstudy lms | Missing Authorization vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-management-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MasterStudy LMS: from n/a through 3.7.55. | Thu 29 Oct |
| CVE-2026-57640 | 4.3 medium | 0.00% | no CPE yet | Subscriber Broken Access Control in MasterStudy LMS <= 3.7.30 versions. | Sun 25 Oct |
| CVE-2025-59577 | 4.3 medium | 0.00% | no CPE yet | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Leveraging Race Conditions.This issue affects MasterStudy LMS: from n/a through <= 3.6.20. | 11 Oct |
| CVE-2026-88849 | 2.7 low | 0.00% | no CPE yet | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.55 does not verify that a user targeted through its student-enrolment feature has any relationship to the requesting instructor, allowing users with the Instructor role to overwrite the first name, last name and public display name of any registered user on the site, including administrators, enabling impersonation and phishing. | 22 Oct |
18 of 18
Download these 18 as CSV · subscribe to this list.
EPSS scores: 2026-10-29. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.