Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Masteriyo LMS 3.4.1 Clear all filters
TI-2026-57155 CVE-2026-82851 · GHSA-pwq8-2w9x-rh69

Masteriyo LMS 1.14.0 - 3.4.0 - Instructor+ Arbitrary Post Disclosure via IDOR

Priority LOW 13

The Masteriyo LMS WordPress plugin before 3.4.1 does not verify ownership of, or restrict the type of, the records a user requests for download, allowing users with the instructor role to retrieve the full content and me…

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00299 Published 2026-09-12 Fixed in 3.4.1 CWE-639
TI-2026-57151 CVE-2026-82847 · GHSA-8hqp-p78r-mqpg

Masteriyo LMS < 3.4.1 - Instructor+ Stored XSS via Course Highlights

Priority LOW 32

The Masteriyo LMS WordPress plugin before 3.4.1 does not sanitise and escape one of its course fields before outputting it back in the course editor, allowing users with the instructor role to perform Stored Cross-Site S…

CVSS 3.1MEDIUM 6.8 Network High privileges User interaction EPSS 0.00431 Published 2026-09-12 Fixed in 3.4.1 CWE-79
TI-2026-57149 CVE-2026-82845 · GHSA-mv63-gmf8-5x76

Masteriyo LMS < 3.4.1 - Subscriber+ PHP Object Injection

Priority MEDIUM 44

The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metadata from being deserialized when they are read back, allowing users with a minimal account to inject arbitrary PHP object…

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00638 Published 2026-09-12 Fixed in 3.4.1 CWE-502