CVE-2026-0559: falha de média gravidade em stylemix MasterStudy LMS WordPress Plugin…
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'stm_lms_courses_grid_display' Shortcode
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.4epss 0.2%
The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'stm_lms_courses_grid_display' shortcode in all versions up to, and including, 3.7.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CVEs relacionadas — stylemix MasterStudy LMS WordPress Plugin…
No mesmo produto, das mais perigosas para as menos.
CVE-2024-1512CRITICALMasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.2.5 - Unauthenticated SQL InjectionEPSS 77.7%CVE-2024-3136CRITICALMasterStudy LMS <= 3.3.3 - Unauthenticated Local File Inclusion via templateEPSS 5.0%CVE-2024-2411CRITICALMasterStudy LMS <= 3.3.0 - Unauthenticated Local File Inclusion via modalEPSS 1.5%CVE-2024-2409CRITICALMasterStudy LMS <= 3.3.1 - Unauthenticated Privilege Escalation via stm_lms_register AJAX ActionEPSS 0.8%CVE-2024-2106MEDIUMMasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.2.10 - Basic Information Exposure via REST routeEPSS 0.8%CVE-2024-1904MEDIUMMasterStudy LMS <= 3.2.13 - Missing Authorization to Sensitive Information Exposure in search_postsEPSS 0.5%