Masteriyo vulnerabilities
18 vulnerabilities
Known vulnerabilities in Masteriyo products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 4 products.
Products
4- Masteriyo LMS12 vulnerabilities
- Masteriyo5 vulnerabilities
- Masteriyo LMS – Online Course Builder For Elearning, LMS & Education4 vulnerabilities
- Masteriyo LMS – LMS Course Builder, Quizzes & Certificates2 vulnerabilities
CVE-2025-54699masteriyomasteriyo - lms+1
EPSS score0.22%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in masteriyo Masteriyo - LMS learning-management-system allows Stored XSS.This issue affects Masteriyo - LMS: from n/a through <= 1.18.3.CVE-2025-64270masteriyomasteriyo - lms+1EPSS score0.32%
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in masteriyo Masteriyo - LMS learning-management-system allows Retrieve Embedded Sensitive Data.This issue affects Masteriyo - LMS: from n/a through <= 2.0.3.CVE-2024-43159masteriyomasteriyo+2EPSS score0.42%
Missing Authorization vulnerability in masteriyo Masteriyo - LMS learning-management-system.This issue affects Masteriyo - LMS: from n/a through <= 1.11.6.CVE-2024-43158masteriyomasteriyo+2EPSS score0.52%
Missing Authorization vulnerability in masteriyo Masteriyo - LMS learning-management-system.This issue affects Masteriyo - LMS: from n/a through <= 1.11.4.CVE-2024-43239masteriyomasteriyo+2EPSS score0.29%
Authorization Bypass Through User-Controlled Key vulnerability in masteriyo Masteriyo - LMS learning-management-system.This issue affects Masteriyo - LMS: from n/a through <= 1.11.4.CVE-2024-10008masteriyomasteriyo+2EPSS score0.63%
The Masteriyo LMS – eLearning and Online Course Builder for WordPress plugin for WordPress is vulnerable to unauthorized user profile modification due to missing authorization checks on the /wp-json/masteriyo/v1/users/$id REST API endpoint in all versions up to, and including, 1.13.3. This makes it possible for authenticated attackers, with student-level access and above, to modify the roles of arbitrary users. As a result, attackers can escalate their privileges to the Administrator and demote existing administrators to students.CVE-2024-10000masteriyomasteriyo+2EPSS score0.28%
The Masteriyo LMS – eLearning and Online Course Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the question's content parameter in all versions up to, and including, 1.13.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with student-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2024-24882masteriyomasteriyo - lms+2EPSS score2.09%
Incorrect Privilege Assignment vulnerability in masteriyo Masteriyo - LMS learning-management-system.This issue affects Masteriyo - LMS: from n/a through <= 1.7.2.CVE-2024-33939masteriyomasteriyo - lms+2EPSS score0.94%
Authentication Bypass Using an Alternate Path or Channel vulnerability in masteriyo Masteriyo - LMS learning-management-system.This issue affects Masteriyo - LMS: from n/a through <= 1.7.3.CVE-2026-73996masteriyomasteriyo - lms+1EPSS score0.52%
Unauthenticated Arbitrary File Upload in Masteriyo - LMS <= 2.3.2 versions.CVE-2026-59513masteriyomasteriyo - lms+1EPSS score0.22%
Subscriber Cross Site Scripting (XSS) in Masteriyo - LMS <= 2.3.0 versions.CVE-2026-65463masteriyomasteriyo - lms+1EPSS score0.29%
Subscriber Insecure Direct Object References (IDOR) in Masteriyo - LMS <= 2.3.1 versions.CVE-2026-62132masteriyomasteriyo - lms+1EPSS score0.29%
Subscriber Broken Access Control in Masteriyo - LMS <= 3.4.0 versions.CVE-2026-62107masteriyomasteriyo - lms+1EPSS score0.52%
Unauthenticated PHP Object Injection in Masteriyo - LMS <= 3.4.0 versions.CVE-2026-11773masteriyomasteriyo lms – lms course builder, quizzes & certificates+1EPSS score0.25%
The Masteriyo LMS – LMS Course Builder, Quizzes & Certificates plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.2.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with student-level access and above, to modify the description (post content) of arbitrary course announcements authored by instructors or administrators.CVE-2026-4484masteriyomasteriyo lms – online course builder for elearning, lms & education+1EPSS score0.51%
The Masteriyo LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.1.6. This is due to the plugin allowing a user to update the user role through the 'InstructorsController::prepare_object_for_database' function. This makes it possible for authenticated attackers, with Student-level access and above, to elevate their privileges to that of an administrator.CVE-2026-5167masteriyomasteriyo lms – online course builder for elearning, lms & education+1EPSS score0.49%
The Masteriyo LMS – Online Course Builder for eLearning, LMS & Education plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in versions up to and including 2.1.7. This is due to insufficient webhook signature verification in the handle_webhook() function. The webhook endpoint processes unauthenticated requests and only performs signature verification if both the webhook_secret setting is configured AND the HTTP_STRIPE_SIGNATURE header is present. Since webhook_secret defaults to an empty string, the webhook processes attacker-controlled JSON payloads without any verification. This makes it possible for unauthenticated attackers to send fake Stripe webhook events with arbitrary order_id values in the metadata, mark any order as completed without payment, and gain unauthorized access to paid course content.CVE-2026-8279masteriyomasteriyo lms – lms course builder, quizzes & certificates+1EPSS score0.40%
The Masteriyo LMS plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the 'delete_item_permissions_check' function in the CourseProgressItemsController in all versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to delete arbitrary course progress records belonging to any student.