Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
970 results · page 7 of 20
Mar 6, 2026DoceboLMS 1.2 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the id,CVE-2018-25170 · Other software · Spaghettilearning · reported by VulnCheckHigh 8.8
DoceboLMS 1.2 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the id, idC, and idU parameters. Attackers can send GET requests to the lesson.php endpoint with malicious SQL payloads to extract sensitive database information.
- Product
- DoceboLMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comvulncheck.com
Mar 6, 2026LangBot is a global IM bot platform designed for LLMs.CVE-2026-28509 · Other software · langbot-app · reported by GitHubMedium 6.3
LangBot is a global IM bot platform designed for LLMs. Prior to version 4.8.7, LangBot’s web UI renders user-supplied raw HTML using rehypeRaw, which can lead to a cross-site scripting (XSS) vulnerability. This issue has been patched in version 4.8.7.
- Product
- LangBot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2026Chamilo is a learning management system.CVE-2026-29041 · Other software · chamilo · reported by GitHubHigh 8.8
Chamilo is a learning management system. Prior to version 1.11.34, Chamilo LMS is affected by an authenticated remote code execution vulnerability caused by improper validation of uploaded files. The application relies solely on MIME-type verification when handling file uploads and does not adequately validate file extensions or enforce safe server-side storage restrictions. As a result, an authenticated low-privileged user can upload a crafted file containing executable code and subsequently execute arbitrary commands on the server. This issue has been patched in version 1.11.34.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2026Chamilo is a learning management system.CVE-2025-59544 · Other software · chamilo · reported by GitHubMedium 6.9
Chamilo is a learning management system. Prior to version 1.11.34, the functionality for the user to update the category does not implement authorization checks for the "category_id" parameter which allows users to update the category of any user by replacing the "category_id" parameter. This issue has been patched in version 1.11.34.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2026Chamilo is a learning management system.CVE-2025-59543 · Other software · chamilo · reported by GitHubCritical 9
Chamilo is a learning management system. Prior to version 1.11.34, there is a stored cross-site scripting (XSS) vulnerability. By injecting malicious JavaScript into the course description field, an attacker with a low-privileged account (e.g., trainer) can execute arbitrary JavaScript code in the context of any other user viewing the course information page, including administrators. This allows an attacker to exfiltrate sensitive session cookies or tokens, resulting in account takeover (ATO) of higher-privileged users. This issue has been patched in version 1.11.34.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2026Chamilo is a learning management system.CVE-2025-59542 · Other software · chamilo · reported by GitHubCritical 9
Chamilo is a learning management system. Prior to version 1.11.34, there is a stored cross-site scripting (XSS) vulnerability. By injecting malicious JavaScript into the course learning path Settings field, an attacker with a low-privileged account (e.g., trainer) can execute arbitrary JavaScript code in the context of any other user viewing the course information page, including administrators. This allows an attacker to exfiltrate sensitive session cookies or tokens, resulting in account takeover (ATO) of higher-privileged users. This issue has been patched in version 1.11.34.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2026Chamilo is a learning management system.CVE-2025-59541 · Other software · chamilo · reported by GitHubHigh 8.1
Chamilo is a learning management system. Prior to version 1.11.34, a Cross-Site Request Forgery (CSRF) vulnerability allows an attacker to delete projects inside a course without the victim’s consent. The issue arises because sensitive actions such as project deletion do not implement anti-CSRF protections (tokens) and GET based requests. As a result, an authenticated user (Trainer) can be tricked into executing this unwanted action by simply visiting a malicious page. This issue has been patched in version 1.11.34.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2026Chamilo is a learning management system.CVE-2025-59540 · Other software · chamilo · reported by GitHubMedium 6.4
Chamilo is a learning management system. Prior to version 1.11.34, a stored XSS vulnerability exists in Chamilo LMS that allows a staff account to execute arbitrary JavaScript in the browser of higher-privileged admin users. The issue arises because feedback input in the exercise history page is not properly encoded before rendering, allowing malicious scripts to persist in the database and execute on view. This issue has been patched in version 1.11.34.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2026Chamilo is a learning management system.CVE-2025-55289 · Other software · chamilo · reported by GitHubHigh 8.8
Chamilo is a learning management system. Prior to version 1.11.34, there is a stored XSS vulnerability in Chamilo LMS (Verison 1.11.32) allows an attacker to inject arbitrary JavaScript into the platform’s social network and internal messaging features. When viewed by an authenticated user (including administrators), the payload executes in their browser within the LMS context. This enables full account takeover via session hijacking, unauthorized actions with the victim’s privileges, exfiltration of sensitive data, and potential self-propagation to other users. This issue has been patched in version 1.11.34.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2026Chamilo is a learning management system.CVE-2025-55208 · Other software · chamilo · reported by GitHubCritical 9
Chamilo is a learning management system. Versions prior to 1.11.34 have a Stored XSS through insecure file uploads in `Social Networks`. Through it, a low-privilege user can execute arbitrary code in the admin user inbox, allowing takeover of the admin account. Version 1.11.34 fixes the issue.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2026LMS Elementor Pro: Incorrect Privilege AssignmentCVE-2026-27983 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in designthemes LMS Elementor Pro lms-elementor-pro allows Privilege Escalation.This issue affects LMS Elementor Pro: from n/a through <= 1.0.4.
- Product
- LMS Elementor Pro
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update LMS Elementor Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 5, 2026Tutor LMS: Missing AuthorizationCVE-2026-23799 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through <= 3.9.5.
- Product
- Tutor LMS
- Affected
- up to 3.9.5
- What to do
- Affects up to 3.9.5. Update Tutor LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 2, 2026Chamilo is a learning management system.CVE-2025-52998 · Other software · chamilo · reported by GitHubHigh 7
Chamilo is a learning management system. Prior to version 1.11.30, in the application, deserialization of data is performed, the data can be spoofed. An attacker can create objects of arbitrary classes, as well as fully control their properties, and thus modify the logic of the web application's operation. This issue has been patched in version 1.11.30.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Chamilo is a learning management system.CVE-2025-52564 · Other software · chamilo · reported by GitHubMedium 6.9
Chamilo is a learning management system. Prior to version 1.11.30, the open parameter of help.php fails to properly sanitize user input. This allows an attacker to inject arbitrary HTML, such as underlined text, via a crafted URL. This issue has been patched in version 1.11.30.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Chamilo is a learning management system.CVE-2025-52563 · Other software · chamilo · reported by GitHubMedium 5.1
Chamilo is a learning management system. Prior to version 1.11.30, there is a reflected cross-site scripting (XSS) vulnerability due to insufficient sanitization of the page parameter in the session/add_users_to_session.php endpoint. This issue has been patched in version 1.11.30.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Chamilo is a learning management system.CVE-2025-52476 · Other software · chamilo · reported by GitHubMedium 5.1
Chamilo is a learning management system. Prior to version 1.11.30, there is a reflected cross-site scripting (XSS) vulnerability due to improper sanitization of the keyword_active parameter in admin/user_list.php. This issue has been patched in version 1.11.30.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Chamilo is a learning management system.CVE-2025-52475 · Other software · chamilo · reported by GitHubMedium 5.1
Chamilo is a learning management system. Prior to version 1.11.30, there is a reflected cross-site scripting (XSS) vulnerability in the admin/user_list.php endpoint. The keyword_inactive parameter is not properly sanitized, allowing attackers to inject malicious JavaScript through a crafted URL. This issue has been patched in version 1.11.30.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Chamilo is a learning management system.CVE-2025-52470 · Other software · chamilo · reported by GitHubMedium 4.8
Chamilo is a learning management system. Prior to version 1.11.30, a stored cross-site scripting (XSS) vulnerability exists in the session_category_add.php script. The vulnerability is caused by improper sanitization of the Category Name field, allowing privileged users to inject persistent JavaScript payloads. The injected script is later executed when accessing add_many_sessions_to_category.php, potentially compromising administrative sessions. This issue has been patched in version 1.11.30.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Chamilo is a learning management system.CVE-2025-52469 · Other software · chamilo · reported by GitHubHigh 7.1
Chamilo is a learning management system. Prior to version 1.11.30, a logic vulnerability in the friend request workflow of Chamilo’s social network module allows an authenticated user to forcibly add any user as a friend by directly calling the AJAX endpoint. The attacker can bypass the normal flow of sending and accepting friend requests, and even add non-existent users. This breaks access control and social interaction logic, with potential privacy implications. This issue has been patched in version 1.11.30.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Chamilo is a learning management system.CVE-2025-52468 · Other software · chamilo · reported by GitHubHigh 8.8
Chamilo is a learning management system. Prior to version 1.11.30, an input validation vulnerability exists when importing user data from CSV files. This flaw occurs due to insufficient sanitization of user data, specifically in the "Last Name", "First Name", and "Username" fields. It allows attackers to inject a stored cross-site scripting (XSS) payload that is triggered when the user profile is viewed, potentially leading to malicious script execution in the context of the authenticated use. This issue has been patched in version 1.11.30.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Chamilo is a learning management system.CVE-2025-50199 · Other software · chamilo · reported by GitHubHigh 7.7
Chamilo is a learning management system. Prior to version 1.11.30, there is a blind SSRF vulnerability in /index.php via the POST openid_url parameter. This issue has been patched in version 1.11.30.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Chamilo is a learning management system.CVE-2025-50198 · Other software · chamilo · reported by GitHubHigh 8.8
Chamilo is a learning management system. Prior to version 1.11.30, Chamilo is vulnerable to deserialization of untrusted data in /plugin/vchamilo/views/import.php via POST configuration_file; POST course_path; POST home_path parameters. This issue has been patched in version 1.11.30.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Chamilo is a learning management system.CVE-2025-50197 · Other software · chamilo · reported by GitHubHigh 7.1
Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection vulnerability in /main/admin/sub_language_ajax.inc.php via the POST new_language parameter. This issue has been patched in version 1.11.30.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Chamilo is a learning management system.CVE-2025-50196 · Other software · chamilo · reported by GitHubHigh 7.1
Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection vulnerability in /plugin/vchamilo/views/editinstance.php via the POST main_database parameter. This issue has been patched in version 1.11.30.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Chamilo is a learning management system.CVE-2025-50195 · Other software · chamilo · reported by GitHubHigh 7.1
Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection vulnerability in /plugin/vchamilo/views/manage.controller.php. This issue has been patched in version 1.11.30.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Chamilo is a learning management system.CVE-2025-50194 · Other software · chamilo · reported by GitHubHigh 7.1
Chamilo is a learning management system. Prior to version 1.11.30, there is an OS Command Injection vulnerability in /main/cron/lang/check_parse_lang.php. This issue has been patched in version 1.11.30.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Chamilo is a learning management system.CVE-2025-50193 · Other software · chamilo · reported by GitHubHigh 7.1
Chamilo is a learning management system. Prior to version 1.11.30, there is an OS command Injection vulnerability in /plugin/vchamilo/views/import.php with the POST to_main_database parameter. This issue has been patched in version 1.11.30.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Chamilo is a learning management system.CVE-2025-52482 · Other software · chamilo · reported by GitHubHigh 8.3
Chamilo is a learning management system. Prior to version 1.11.30, a Stored XSS vulnerability exists in the glossary function, enabling all users with the Teachers role to inject JavaScript malicious code against the administrator. This issue has been patched in version 1.11.30.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Chamilo is a learning management system.CVE-2025-50192 · Other software · chamilo · reported by GitHubHigh 8.8
Chamilo is a learning management system. Prior to version 1.11.30, there is a time-based SQL Injection in found in /main/webservices/registration.soap.php. This issue has been patched in version 1.11.30.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Chamilo is a learning management system.CVE-2025-50191 · Other software · chamilo · reported by GitHubHigh 7
Chamilo is a learning management system. Prior to version 1.11.30, there is an error-based SQL Injection via POST userFile with the /main/exercise/hotpotatoes.php script. This issue has been patched in version 1.11.30.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Chamilo is a learning management system.CVE-2025-50190 · Other software · chamilo · reported by GitHubHigh 8.8
Chamilo is a learning management system. Prior to version 1.11.30, there is an error-based SQL Injection via the GET openid.assoc_handle parameter with the /index.php script. This issue has been patched in version 1.11.30.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Chamilo is a learning management system.CVE-2025-50189 · Other software · chamilo · reported by GitHubHigh 7.2
Chamilo is a learning management system. Prior to version 1.11.30, the application performs insufficient validation of data coming from the user from the POST resource[document][SQL_INJECTION_HERE] and POST login parameters found in /main/coursecopy/copy_course_session_selected.php, which allows an attacker to perform an attack aimed at modifying the database query logic by injecting an arbitrary SQL statements. This issue has been patched in version 1.11.30.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Chamilo is a learning management system.CVE-2025-50188 · Other software · chamilo · reported by GitHubHigh 7
Chamilo is a learning management system. Prior to version 1.11.30, the application performs insufficient validation of data coming from the user from the GET value parameter with the following scripts: /plugin/vchamilo/views/syncparams.php and /plugin/vchamilo/ajax/service.php, which allows an attacker to perform an attack aimed at modifying the database query logic by injecting an arbitrary SQL statements. This issue has been patched in version 1.11.30.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Chamilo is a learning management system.CVE-2025-50187 · Other software · chamilo · reported by GitHubCritical 9.8
Chamilo is a learning management system. Prior to version 1.11.28, parameter from SOAP request is evaluated without filtering which leads to Remote Code Execution. This issue has been patched in version 1.11.28.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Chamilo is a learning management system.CVE-2025-50186 · Other software · chamilo · reported by GitHubMedium 4.8
Chamilo is a learning management system. Prior to version 1.11.30, a stored cross-site scripting (XSS) vulnerability exists due to insufficient sanitization of CSV filenames. An attacker can upload a maliciously named CSV file (e.g., <img src=q onerror=prompt(8)>.csv) that leads to JavaScript execution when viewed by administrators or users with access to import logs or file views. This issue has been patched in version 1.11.30.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Chamilo is a learning management system.CVE-2024-50337 · Other software · chamilo · reported by GitHubMedium 5.3
Chamilo is a learning management system. Prior to version 1.11.28, the OpenId function allows anyone to send requests to any URL on server's behalf, which results in unauthenticated blind SSRF. This issue has been patched in version 1.11.28.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Chamilo is a learning management system.CVE-2024-47886 · Other software · chamilo · reported by GitHubHigh 8.7
Chamilo is a learning management system. Chamillo is affected by a post-authentication phar unserialize which leads to a remote code execution (RCE) within versions 1.11.12 to 1.11.26. By abusing multiple supported features from the virtualization plugin vchamilo, the vulnerability allows an administrator to execute arbitrary code on the server. This issue has been patched in version 1.11.26.
- Product
- chamilo-lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2026Tutor LMS – eLearning and online course solution: SQL InjectionCVE-2025-13673 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to SQL Injection via the 'coupon_code' parameter in all versions up to, and including, 3.9.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. NOTE: This vulnerability was partially mitigated in versions 3.9.4 and 3.9.6.
- Product
- Tutor LMS – eLearning and online course solution
- Affected
- up to 3.9.6
- What to do
- Affects up to 3.9.6. Update Tutor LMS – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 27, 2026An attacker may exploit the use of outdated and weak MAC algorithms in the device’s SSH service to potentially compromise the integrity of the SSH session, alloCVE-2026-1627 · Other software · SICK AG · reported by psirt@sick.deMedium 6.5
An attacker may exploit the use of outdated and weak MAC algorithms in the device’s SSH service to potentially compromise the integrity of the SSH session, allowing manipulation of transmitted data if the attacker can interact with the network traffic.
- Product
- SICK LMS1000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2026An attacker may exploit the use of weak CBC-based cipher suites in the device’s SSH service to potentially observe or manipulate parts of the encrypted SSH commCVE-2026-1626 · Other software · SICK AG · reported by psirt@sick.deMedium 6.5
An attacker may exploit the use of weak CBC-based cipher suites in the device’s SSH service to potentially observe or manipulate parts of the encrypted SSH communication, if they are able to intercept or interact with the network traffic.
- Product
- SICK LMS1000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026An issue in OpenFUN Richie (LMS) in src/richie/apps/courses/api.py.CVE-2026-26717 · Other software · reported by MITREMedium 4.8
An issue in OpenFUN Richie (LMS) in src/richie/apps/courses/api.py. The application used the non-constant time == operator for HMAC signature verification in the sync_course_run_from_request function. This allows remote attackers to forge valid signatures and bypass authentication by measuring response time discrepancies
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2026Chamilo LMS 1.11.8 contains an arbitrary file upload vulnerability that allows authenticated users to upload and execute PHP files through the elfinder filemanaCVE-2018-25158 · Other software · Chamilo · reported by VulnCheckHigh 8.7
Chamilo LMS 1.11.8 contains an arbitrary file upload vulnerability that allows authenticated users to upload and execute PHP files through the elfinder filemanager module. Attackers can upload files with image headers in the social myfiles section, rename them to PHP extensions, and execute arbitrary code by accessing the uploaded files.
- Product
- Chamillo LMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Feb 19, 2026Frappe Learning Management System (LMS) is a learning system that helps users structure their content.CVE-2026-26977 · Other software · frappe · reported by GitHubMedium 6.9
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. In versions 2.44.0 and below, unauthorized users are able to access the details of unpublished courses via API endpoints. A fix for this issue is planned for the 2.45.0 release.
- Product
- lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026A user enumeration vulnerability exists in FormaLMS 4.1.18 and below in the password recovery functionality accessible via the /lostpwd endpoint.CVE-2026-26744 · Other software · Formalms · reported by MITREMedium 5.3
A user enumeration vulnerability exists in FormaLMS 4.1.18 and below in the password recovery functionality accessible via the /lostpwd endpoint. The application returns different error messages for valid and invalid usernames allowing an unauthenticated attacker to determine which usernames are registered in the system through observable response discrepancy.
- Product
- Formalms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026Academy LMS: Missing AuthorizationCVE-2026-25372 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Kodezen LLC Academy LMS academy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Academy LMS: from n/a through <= 3.5.3.
- Product
- Academy LMS
- Affected
- up to 3.5.3
- What to do
- Affects up to 3.5.3. Update Academy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Feb 19, 2026Lizza LMS Pro: Privilege EscalationCVE-2025-13563 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Lizza LMS Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.3. This is due to the 'lizza_lms_pro_register_user_front_end' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site.
- Product
- Lizza LMS Pro
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update Lizza LMS Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.networdfence.com
Feb 14, 2026MasterStudy LMS WordPress Plugin – for Online Courses and Education: Stored Cross-Site ScriptingCVE-2026-0559 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'stm_lms_courses_grid_display' shortcode in all versions up to, and including, 3.7.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- MasterStudy LMS WordPress Plugin – for Online Courses and Education
- Affected
- up to 3.7.11
- What to do
- Affects up to 3.7.11. Update MasterStudy LMS WordPress Plugin – for Online Courses and Education to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Feb 11, 2026Frappe Learning Management System (LMS) is a learning system that helps users structure their content.CVE-2026-26031 · Other software · frappe · reported by GitHubLow 1.3
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to 2.44.0, security issue was identified in Frappe Learning, where unauthorised users were able to access the full list of enrolled students (by email) in batches. This vulnerability is fixed in 2.44.0.
- Product
- lms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026Creativeitem Academy LMS 7.0 contains reflected Cross-Site Scripting (XSS) vulnerabilities via the search parameter to the /academy/blogs endpoint, and the striCVE-2025-71179 · Other software · Creativeitem · reported by MITREMedium 6.1
Creativeitem Academy LMS 7.0 contains reflected Cross-Site Scripting (XSS) vulnerabilities via the search parameter to the /academy/blogs endpoint, and the string parameter to the /academy/course_bundles/search/query endpoint. These vulnerabilities are distinct from the patch for CVE-2023-4119, which only fixed XSS in query and sort_by parameters to the /academy/home/courses endpoint.
- Product
- Academy LMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodecanyon.netcreativeitem.com
Feb 3, 2026Tutor LMS – eLearning and online course solution: Insecure Direct Object References (IDOR)CVE-2026-1375 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object References (IDOR) in all versions up to, and including, 3.9.5. This is due to missing object-level authorization checks in the `course_list_bulk_action()`, `bulk_delete_course()`, and `update_course_status()` functions. This makes it possible for authenticated attackers, with Tutor Instructor-level access and above, to modify or delete arbitrary courses they do not own by manipulating course IDs in bulk action requests.
- Product
- Tutor LMS – eLearning and online course solution
- Affected
- up to 3.9.5
- What to do
- Affects up to 3.9.5. Update Tutor LMS – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.