Advisories · Technology

stylemix MasterStudy LMS WordPress Plugin – for Online Courses and Education.

Every CVE that names stylemix MasterStudy LMS WordPress Plugin – for Online Courses and Education among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-5060 CVE record

CVSS 6.5 Medium

MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.14 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Attachment Deletion
- stylemix MasterStudy LMS WordPress Plugin – for Online Courses and Education
- Broken access control
Not analysed yet 29 Jul 2026
CVE-2026-4817 CVE record

CVSS 6.5 Medium

MasterStudy LMS <= 3.7.25 - Authenticated (Subscriber+) Time-based Blind SQL Injection via 'order' and 'orderby' Parameters
- stylemix MasterStudy LMS WordPress Plugin – for Online Courses and Education
- SQL injection
Not analysed yet 17 Apr 2026
CVE-2026-0559 CVE record

CVSS 6.4 Medium

MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'stm_lms_courses_grid_display' Shortcode
- stylemix MasterStudy LMS WordPress Plugin – for Online Courses and Education
- Cross-site scripting (XSS)
Not analysed yet 14 Feb 2026
CVE-2025-13766 CVE record

CVSS 5.4 Medium

MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.6 Missing Authorization to Authenticated (Subscriber+) Posts and Media Creation, Modification and Deletion
- stylemix MasterStudy LMS WordPress Plugin – for Online Courses and Education
- Broken access control
Not analysed yet 6 Jan 2026
CVE-2024-3942 CVE record

CVSS 6.3 Medium

MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.3.8 - Missing Authorization
- stylemix MasterStudy LMS WordPress Plugin – for Online Courses and Education
- Broken access control
Not analysed yet 2 May 2024
CVE-2024-3136 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

MasterStudy LMS <= 3.3.3 - Unauthenticated Local File Inclusion via template
- stylemix MasterStudy LMS WordPress Plugin – for Online Courses and Education
- File inclusion
Not analysed yet 9 Apr 2024
CVE-2024-1904 CVE record

CVSS 4.3 Medium

MasterStudy LMS <= 3.2.13 - Missing Authorization to Sensitive Information Exposure in search_posts
- stylemix MasterStudy LMS WordPress Plugin – for Online Courses and Education
- Broken access control
Not analysed yet 9 Apr 2024
CVE-2024-2411 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

MasterStudy LMS <= 3.3.0 - Unauthenticated Local File Inclusion via modal
- stylemix MasterStudy LMS WordPress Plugin – for Online Courses and Education
- File inclusion
Not analysed yet 29 Mar 2024
CVE-2024-2409 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

MasterStudy LMS <= 3.3.1 - Unauthenticated Privilege Escalation via stm_lms_register AJAX Action
- stylemix MasterStudy LMS WordPress Plugin – for Online Courses and Education
- Privilege escalation
Not analysed yet 29 Mar 2024
CVE-2024-2106 CVE record

CVSS 5.3 Medium

MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.2.10 - Basic Information Exposure via REST route
- stylemix MasterStudy LMS WordPress Plugin – for Online Courses and Education
- Information disclosure
Not analysed yet 13 Mar 2024
CVE-2024-1512 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.2.5 - Unauthenticated SQL Injection
- stylemix MasterStudy LMS WordPress Plugin – for Online Courses and Education
- SQL injection
Not analysed yet 17 Feb 2024