CVE-2026-65555criticalCWE-266

CVE-2026-65555: critical vulnerability in Uncanny Toolkit for LearnDash

WordPress Uncanny Toolkit for LearnDash plugin <= 3.8.2 - Privilege Escalation vulnerability

Published

Follow this CVE+ Monitor Uncanny Toolkit for LearnDash

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

25Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.8
Incorrect Privilege Assignment vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash uncanny-learndash-toolkit allows Privilege Escalation.This issue affects Uncanny Toolkit for LearnDash: from n/a through 3.8.2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Uncanny Owl · Uncanny Toolkit for LearnDash
Related CVEs — Uncanny Toolkit for LearnDash

In the same product, most dangerous first.

CVE-2023-34020MEDIUMWordPress Uncanny Toolkit for LearnDash plugin <= 3.6.4.3 - Open Redirection vulnerabilityEPSS 1.0%CVE-2023-34019MEDIUMWordPress Uncanny Toolkit for LearnDash plugin <= 3.6.4.3 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2025-22268MEDIUMWordPress Uncanny Toolkit for LearnDash plugin <= 3.7.0.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2023-23714MEDIUMWordPress Uncanny Toolkit for LearnDash Plugin <= 3.6.4.1 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.3%CVE-2025-57988MEDIUMWordPress Uncanny Toolkit for LearnDash Plugin <= 3.7.0.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-48080MEDIUMWordPress Uncanny Toolkit for LearnDash plugin <= 3.7.0.2 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%