# ThemeGrill Masteriyo-Lms vulnerabilities Source: https://junglewise.ai/threats/technologies/masteriyo-lms Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/masteriyo-lms.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 12 vulnerabilities in ThemeGrill Masteriyo-Lms: 0 in the last 7 days and 6 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-116410, was published on 30 October 2026. 1 vulnerability in the last four weeks, up from none in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 1 - Last 90 days: 6 - All time: 12 (1 critical, 0 exploited in the wild) ## About ThemeGrill Masteriyo-Lms Masteriyo is a learning management system plugin for WordPress. ## Latest ThemeGrill Masteriyo-Lms vulnerabilities - [CVE-2026-116410: Masteriyo LMS arbitrary content deletion](https://junglewise.ai/threats/cve-2026-116410-unauthenticated-arbitrary-content-deletion-in-masteriyo-lms-3-4) (medium, CVSS 6.5, published 30 Oct 2026) - [CVE-2026-82847: Masteriyo LMS stored XSS in course highlights field](https://junglewise.ai/threats/cve-2026-82847-masteriyo-lms-stored-xss-in-course-highlights-field) (medium, CVSS 6.8, published 12 Sep 2026) - [CVE-2026-82845: Masteriyo LMS PHP object injection in metadata deserialization](https://junglewise.ai/threats/cve-2026-82845-masteriyo-lms-php-object-injection-in-metadata-deserialization) (critical, CVSS 9.9, published 12 Sep 2026) - [CVE-2026-62132: Masteriyo LMS broken access control in subscriber pages](https://junglewise.ai/threats/cve-2026-62132-masteriyo-lms-broken-access-control-in-subscriber-pages) (medium, CVSS 5.3, published 11 Sep 2026) - [CVE-2026-62107: Masteriyo LMS PHP object injection vulnerability](https://junglewise.ai/threats/cve-2026-62107-masteriyo-lms-php-object-injection-vulnerability) (high, CVSS 8.8, published 11 Sep 2026) - [CVE-2026-8279: Masteriyo LMS authorization bypass in course progress deletion](https://junglewise.ai/threats/cve-2026-8279-masteriyo-lms-authorization-bypass-in-course-progress-deletion) (medium, CVSS 5.3, published 7 Sep 2026) - [CVE-2026-13332: Masteriyo LMS unauthenticated session termination in AJAX action](https://junglewise.ai/threats/cve-2026-13332-masteriyo-lms-unauthenticated-session-termination-in-ajax-action) (info, CVSS 3.7, published 27 Jul 2026) - [CVE-2026-65463: ThemeGrill Masteriyo LMS IDOR in versions up to 2.3.1](https://junglewise.ai/threats/cve-2026-65463-themegrill-masteriyo-lms-idor-in-versions-up-to-2-3-1) (medium, CVSS 5.4, published 23 Jul 2026) - [CVE-2026-59513: Masteriyo LMS Subscriber Cross Site Scripting](https://junglewise.ai/threats/cve-2026-59513-masteriyo-lms-subscriber-cross-site-scripting) (medium, CVSS 6.5, published 23 Jul 2026) - [CVE-2026-10824: Masteriyo LMS authorization bypass in course-progress REST API](https://junglewise.ai/threats/cve-2026-10824-masteriyo-lms-authorization-bypass-in-course-progress-rest-api) (info, CVSS 6.5, published 25 Jun 2026) - [CVE-2026-42743: ThemeGrill Masteriyo LMS broken authentication](https://junglewise.ai/threats/cve-2026-42743-themegrill-masteriyo-lms-broken-authentication) (medium, CVSS 6.5, published 15 Jun 2026) - [CVE-2026-39524: ThemeGrill Masteriyo LMS broken access control payment bypass](https://junglewise.ai/threats/cve-2026-39524-themegrill-masteriyo-lms-broken-access-control-payment-bypass) (high, CVSS 7.5, published 15 Jun 2026) ## Most severe ThemeGrill Masteriyo-Lms vulnerabilities - [CVE-2026-82845: Masteriyo LMS PHP object injection in metadata deserialization](https://junglewise.ai/threats/cve-2026-82845-masteriyo-lms-php-object-injection-in-metadata-deserialization) (critical, CVSS 9.9, published 12 Sep 2026) - [CVE-2026-62107: Masteriyo LMS PHP object injection vulnerability](https://junglewise.ai/threats/cve-2026-62107-masteriyo-lms-php-object-injection-vulnerability) (high, CVSS 8.8, published 11 Sep 2026) - [CVE-2026-39524: ThemeGrill Masteriyo LMS broken access control payment bypass](https://junglewise.ai/threats/cve-2026-39524-themegrill-masteriyo-lms-broken-access-control-payment-bypass) (high, CVSS 7.5, published 15 Jun 2026) - [CVE-2026-82847: Masteriyo LMS stored XSS in course highlights field](https://junglewise.ai/threats/cve-2026-82847-masteriyo-lms-stored-xss-in-course-highlights-field) (medium, CVSS 6.8, published 12 Sep 2026) - [CVE-2026-116410: Masteriyo LMS arbitrary content deletion](https://junglewise.ai/threats/cve-2026-116410-unauthenticated-arbitrary-content-deletion-in-masteriyo-lms-3-4) (medium, CVSS 6.5, published 30 Oct 2026) - [CVE-2026-59513: Masteriyo LMS Subscriber Cross Site Scripting](https://junglewise.ai/threats/cve-2026-59513-masteriyo-lms-subscriber-cross-site-scripting) (medium, CVSS 6.5, published 23 Jul 2026) - [CVE-2026-42743: ThemeGrill Masteriyo LMS broken authentication](https://junglewise.ai/threats/cve-2026-42743-themegrill-masteriyo-lms-broken-authentication) (medium, CVSS 6.5, published 15 Jun 2026) - [CVE-2026-65463: ThemeGrill Masteriyo LMS IDOR in versions up to 2.3.1](https://junglewise.ai/threats/cve-2026-65463-themegrill-masteriyo-lms-idor-in-versions-up-to-2-3-1) (medium, CVSS 5.4, published 23 Jul 2026) - [CVE-2026-8279: Masteriyo LMS authorization bypass in course progress deletion](https://junglewise.ai/threats/cve-2026-8279-masteriyo-lms-authorization-bypass-in-course-progress-deletion) (medium, CVSS 5.3, published 7 Sep 2026) - [CVE-2026-62132: Masteriyo LMS broken access control in subscriber pages](https://junglewise.ai/threats/cve-2026-62132-masteriyo-lms-broken-access-control-in-subscriber-pages) (medium, CVSS 5.3, published 11 Sep 2026) ## Vulnerabilities per week 1 vulnerability in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 5 | 1 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 1 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other ThemeGrill technologies - [ThemeGrill User Registration](https://junglewise.ai/threats/technologies/themegrill-user-registration): 14 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "ThemeGrill Masteriyo-Lms vulnerabilities", https://junglewise.ai/threats/technologies/masteriyo-lms, 9 November 2026.