Plugin icon

Masteriyo LMS – LMS Course Builder, Quizzes & Certificates

learning-management-system

Vulnerabilities:

17

Last Updated:

June 23, 2026

Active Installs:

5000

Published
Title
Fixed in
CVSS
Published
2026-06-26
Title
Masteriyo LMS < 2.3.0 - Missing Authorization to Authenticated (Student+) Arbitrary Course Announcement Modification
Fixed in
Fixed in 2.3.0
CVSS
4.3 (medium)
Published
2026-06-08
Title
Masteriyo LMS < 2.2.1 - Subscriber+ Privilege Escalation
Fixed in
Fixed in 2.2.1
CVSS
8.8 (high)
Published
2026-06-04
Title
Masteriyo LMS < 2.2.1 - Unauthenticated Course Progress Disclosure and Deletion
Fixed in
Fixed in 2.2.1
CVSS
6.5 (medium)
Published
2026-05-28
Title
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates < 2.1.9 - Missing Authorization
Fixed in
Fixed in 2.1.9
CVSS
5.3 (medium)
Published
2026-04-08
Title
Masteriyo LMS – Online Course Builder for eLearning, LMS & Education < 2.1.6 - Missing Authorization
Fixed in
Fixed in 2.1.6
CVSS
5.3 (medium)
Published
2026-04-07
Title
Masteriyo LMS < 2.1.8 - Unauthenticated Authorization Bypass to Arbitrary Order Completion via Stripe Webhook Endpoint
Fixed in
Fixed in 2.1.8
CVSS
5.3 (medium)
Published
2026-03-25
Title
Masteriyo LMS < 2.1.7 - Subscriber+ Privilege Escalation
Fixed in
Fixed in 2.1.7
CVSS
8.8 (high)
Published
2025-11-30
Title
Masteriyo - LMS < 2.0.4 - Authenticated (Subscriber+) Sensitive Information Exposure
Fixed in
Fixed in 2.0.4
CVSS
4.3 (medium)
Published
2025-07-30
Title
Masteriyo - LMS < 1.18.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 1.18.4
CVSS
6.4 (medium)
Published
2024-10-28
Title
Masteriyo LMS – eLearning and Online Course Builder for WordPress < 1.13.4 - Authenticated (Student+) Stored Cross-Site Scripting via Ask a Question Functionality
Fixed in
Fixed in 1.13.4
CVSS
6.4 (medium)
Published
2024-10-28
Title
Masteriyo LMS < 1.13.4 - Subscriber+ Privilege Escalation
Fixed in
Fixed in 1.13.4
CVSS
8.8 (high)
Published
2024-08-12
Title
Masteriyo - LMS < 1.11.5 - Authenticated (Student+) Insecure Direct Object Reference
Fixed in
Fixed in 1.11.5
CVSS
5.3 (medium)
Published
2024-08-07
Title
Masteriyo - LMS < 1.12.0 - Missing Authorization
Fixed in
Fixed in 1.12.0
CVSS
5.3 (medium)
Published
2024-08-07
Title
Masteriyo - LMS < 1.11.5 - Missing Authorization
Fixed in
Fixed in 1.11.5
CVSS
5.3 (medium)
Published
2024-04-30
Title
Masteriyo - LMS < 1.7.4 - Insecure Direct Object Reference
Fixed in
Fixed in 1.7.4
CVSS
5.3 (medium)
Published
2024-04-05
Title
Masteriyo - LMS < 1.7.3 - Unauthenticated Privilege Escalation
Fixed in
Fixed in 1.7.3
CVSS
9.8 (critical)
Published
2023-07-10
Title
LMS by Masteriyo < 1.6.8 - Information Exposure
Fixed in
Fixed in 1.6.8
CVSS
6.5 (medium)