Plugin icon

Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning

academy
Plugin closed

Vulnerabilities:

20

Last Updated:

October 8, 2026

Active Installs:

2000

Published
Title
Fixed in
CVSS
Published
2026-10-09
Title
Academy LMS < 4.0.4 - Missing Authorization to Authenticated (Custom+) Arbitrary Academy Comment Deletion via delete_lesson_comment AJAX — Attacker-Controlled course_id vs. Target comment_id
Fixed in
Fixed in 4.0.4
CVSS
6.5 (medium)
Published
2026-10-09
Title
Academy LMS < 4.0.4 - Authenticated (Custom+) Privilege Escalation to add_child REST endpoint
Fixed in
Fixed in 4.0.4
CVSS
5.4 (medium)
Published
2026-10-05
Title
Academy LMS < 4.0.0 - Subscriber+ Cross-Course Quiz Answer Disclosure via render_quiz_answers
Fixed in
Fixed in 4.0.0
CVSS
4.3 (medium)
Published
2026-10-05
Title
Academy LMS < 4.0.0 - Subscriber+ Arbitrary Lesson Content Disclosure via Topic REST Endpoint
Fixed in
Fixed in 4.0.0
CVSS
4.3 (medium)
Published
2026-07-24
Title
Academy LMS < 3.8.3 - Subscriber+ Arbitrary Lesson Content Disclosure via lessons REST Endpoint
Fixed in
Fixed in 3.8.3
CVSS
4.3 (medium)
Published
2026-07-14
Title
Academy LMS < 3.8.3 - Subscriber+ Sensitive Information Disclosure via quiz_attempts REST Endpoint
Fixed in
Fixed in 3.8.3
CVSS
6.5 (medium)
Published
2026-07-13
Title
Academy LMS < 3.8.1 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'user_id' Parameter
Fixed in
Fixed in 3.8.1
CVSS
4.3 (medium)
Published
2026-07-01
Title
Academy LMS < 3.8.2 - Unauthenticated Insecure Direct Object Reference to Private Topic Disclosure
Fixed in
Fixed in 3.8.2
CVSS
5.3 (medium)
Published
2026-06-30
Title
Academy LMS < 3.8.1 - Subscriber+ Cross-User Lesson Note and Progress Modification via IDOR
Fixed in
Fixed in 3.8.1
CVSS
5.4 (medium)
Published
2026-02-17
Title
Academy LMS < 3.5.4 - Missing Authorization
Fixed in
Fixed in 3.5.4
CVSS
4.3 (medium)
Published
2026-01-20
Title
Academy LMS – WordPress LMS Plugin for Complete eLearning Solution < 3.5.1 - Unauthenticated Privilege Escalation via Account Takeover
Fixed in
Fixed in 3.5.1
CVSS
9.8 (critical)
Published
2025-12-30
Title
Academy LMS < 3.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 3.4.1
CVSS
6.4 (medium)
Published
2025-11-07
Title
Academy LMS – WordPress LMS Plugin for Complete eLearning Solution < 3.3.9 - Authenticated (Administrator+) PHP Object Injection via 'import_all_courses'
Fixed in
Fixed in 3.3.9
CVSS
7.2 (high)
Published
2025-09-22
Title
Academy LMS < 3.3.5 - Authenticated (Academy Instructor+) Insecure Direct Object Reference
Fixed in
Fixed in 3.3.5
CVSS
4.3 (medium)
Published
2024-07-11
Title
Academy LMS < 2.0.5 - Missing Authorization
Fixed in
Fixed in 2.0.5
CVSS
2.7 (low)
Published
2024-06-21
Title
Academy LMS < 2.0.11 - Open Redirect
Fixed in
Fixed in 2.0.11
CVSS
4.7 (medium)
Published
2024-05-10
Title
Academy LMS < 1.9.26 - Unauthenticated Sensitive Information Exposure
Fixed in
Fixed in 1.9.26
CVSS
5.3 (medium)
Published
2024-04-29
Title
Academy LMS < 1.9.17 - Missing Authorization
Fixed in
Fixed in 1.9.17
CVSS
4.3 (medium)
Published
2024-04-22
Title
Academy LMS < 1.9.17 - Missing Authorization
Fixed in
Fixed in 1.9.17
CVSS
5.4 (medium)
Published
2024-02-21
Title
Academy LMS – eLearning and online course solution for WordPress < 1.9.20 - Authenticated (Subscriber+) Privilege Escalation
Fixed in
Fixed in 1.9.20
CVSS
8.8 (high)