# StylemixThemes MasterStudy LMS vulnerabilities Source: https://junglewise.ai/threats/technologies/masterstudy-lms Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 10 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/masterstudy-lms.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 16 vulnerabilities in StylemixThemes MasterStudy LMS: 1 in the last 7 days and 10 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-119478, was published on 7 November 2026. 4 vulnerabilities in the last four weeks, up from none in the four before. ## Counts - Last 7 days: 1 - Last 30 days: 4 - Last 90 days: 10 - All time: 16 (0 critical, 0 exploited in the wild) ## About StylemixThemes MasterStudy LMS A learning management system plugin for WordPress designed to create and manage online courses. ## Latest StylemixThemes MasterStudy LMS vulnerabilities - [CVE-2026-119478: StylemixThemes MasterStudy LMS content injection via XSS](https://junglewise.ai/threats/cve-2026-119478-improper-neutralization-of-script-related-html-tags-in-a-web) (medium, CVSS 4.3, published 7 Nov 2026) - [CVE-2026-118090: MasterStudy LMS PHP object injection in subscriber handling](https://junglewise.ai/threats/cve-2026-118090-subscriber-php-object-injection-in-masterstudy-lms-3-7-55) (high, CVSS 8.8, published 30 Oct 2026) - [CVE-2026-80067: MasterStudy LMS path traversal in file import](https://junglewise.ai/threats/cve-2026-80067-masterstudy-lms-plugin-for-wordpress-before-3-7-50-contains-a) (medium, CVSS 5.4, published 29 Oct 2026) - [CVE-2026-118092: StylemixThemes MasterStudy LMS broken access control](https://junglewise.ai/threats/cve-2026-118092-missing-authorization-vulnerability-in-stylemixthemes) (medium, CVSS 4.3, published 29 Oct 2026) - [CVE-2026-81199: MasterStudy LMS information disclosure in student stats endpoint](https://junglewise.ai/threats/cve-2026-81199-masterstudy-lms-information-disclosure-in-student-stats-endpoint) (medium, CVSS 5.3, published 2 Sep 2026) - [CVE-2026-81197: MasterStudy LMS information disclosure in REST API](https://junglewise.ai/threats/cve-2026-81197-masterstudy-lms-information-disclosure-in-rest-api) (medium, CVSS 5.3, published 2 Sep 2026) - [CVE-2026-81195: MasterStudy LMS authorization bypass in student-courses REST API](https://junglewise.ai/threats/cve-2026-81195-masterstudy-lms-authorization-bypass-in-student-courses-rest-api) (medium, CVSS 5.3, published 2 Sep 2026) - [CVE-2026-81194: MasterStudy LMS authorization bypass in order retrieval](https://junglewise.ai/threats/cve-2026-81194-masterstudy-lms-authorization-bypass-in-order-retrieval) (medium, CVSS 4.3, published 2 Sep 2026) - [CVE-2026-81200: MasterStudy LMS insecure direct object reference in order access](https://junglewise.ai/threats/cve-2026-81200-masterstudy-lms-insecure-direct-object-reference-in-order-access) (low, CVSS 2.7, published 29 Aug 2026) - [CVE-2026-78284: MasterStudy LMS unauthenticated arbitrary file deletion](https://junglewise.ai/threats/cve-2026-78284-masterstudy-lms-unauthenticated-arbitrary-file-deletion) (high, CVSS 8.6, published 24 Aug 2026) - [CVE-2026-28145: StylemixThemes MasterStudy LMS user state manipulation](https://junglewise.ai/threats/cve-2026-28145-stylemixthemes-masterstudy-lms-user-state-manipulation) (medium, CVSS 5.3, published 31 Jul 2026) - [CVE-2026-5060: Stylemix MasterStudy LMS IDOR in stm_lms_delete_cover](https://junglewise.ai/threats/cve-2026-5060-stylemix-masterstudy-lms-idor-in-stm-lms-delete-cover) (medium, CVSS 6.5, published 29 Jul 2026) - [CVE-2026-57330: StylemixThemes MasterStudy LMS Cross-Site Scripting via Subscriber role](https://junglewise.ai/threats/cve-2026-57330-stylemixthemes-masterstudy-lms-cross-site-scripting-via) (medium, CVSS 6.5, published 29 Jun 2026) - [CVE-2026-57640: StylemixThemes MasterStudy LMS broken access control](https://junglewise.ai/threats/cve-2026-57640-stylemixthemes-masterstudy-lms-broken-access-control) (medium, CVSS 4.3, published 26 Jun 2026) - [CVE-2026-40766: StylemixThemes MasterStudy LMS SQL injection](https://junglewise.ai/threats/cve-2026-40766-stylemixthemes-masterstudy-lms-sql-injection) (high, CVSS 8.5, published 15 Jun 2026) - [CVE-2026-42730: Stylemix MasterStudy LMS SQL injection](https://junglewise.ai/threats/cve-2026-42730-stylemix-masterstudy-lms-sql-injection) (high, CVSS 8.5, published 27 May 2026) ## Most severe StylemixThemes MasterStudy LMS vulnerabilities - [CVE-2026-118090: MasterStudy LMS PHP object injection in subscriber handling](https://junglewise.ai/threats/cve-2026-118090-subscriber-php-object-injection-in-masterstudy-lms-3-7-55) (high, CVSS 8.8, published 30 Oct 2026) - [CVE-2026-78284: MasterStudy LMS unauthenticated arbitrary file deletion](https://junglewise.ai/threats/cve-2026-78284-masterstudy-lms-unauthenticated-arbitrary-file-deletion) (high, CVSS 8.6, published 24 Aug 2026) - [CVE-2026-40766: StylemixThemes MasterStudy LMS SQL injection](https://junglewise.ai/threats/cve-2026-40766-stylemixthemes-masterstudy-lms-sql-injection) (high, CVSS 8.5, published 15 Jun 2026) - [CVE-2026-42730: Stylemix MasterStudy LMS SQL injection](https://junglewise.ai/threats/cve-2026-42730-stylemix-masterstudy-lms-sql-injection) (high, CVSS 8.5, published 27 May 2026) - [CVE-2026-5060: Stylemix MasterStudy LMS IDOR in stm_lms_delete_cover](https://junglewise.ai/threats/cve-2026-5060-stylemix-masterstudy-lms-idor-in-stm-lms-delete-cover) (medium, CVSS 6.5, published 29 Jul 2026) - [CVE-2026-57330: StylemixThemes MasterStudy LMS Cross-Site Scripting via Subscriber role](https://junglewise.ai/threats/cve-2026-57330-stylemixthemes-masterstudy-lms-cross-site-scripting-via) (medium, CVSS 6.5, published 29 Jun 2026) - [CVE-2026-80067: MasterStudy LMS path traversal in file import](https://junglewise.ai/threats/cve-2026-80067-masterstudy-lms-plugin-for-wordpress-before-3-7-50-contains-a) (medium, CVSS 5.4, published 29 Oct 2026) - [CVE-2026-81199: MasterStudy LMS information disclosure in student stats endpoint](https://junglewise.ai/threats/cve-2026-81199-masterstudy-lms-information-disclosure-in-student-stats-endpoint) (medium, CVSS 5.3, published 2 Sep 2026) - [CVE-2026-81197: MasterStudy LMS information disclosure in REST API](https://junglewise.ai/threats/cve-2026-81197-masterstudy-lms-information-disclosure-in-rest-api) (medium, CVSS 5.3, published 2 Sep 2026) - [CVE-2026-81195: MasterStudy LMS authorization bypass in student-courses REST API](https://junglewise.ai/threats/cve-2026-81195-masterstudy-lms-authorization-bypass-in-student-courses-rest-api) (medium, CVSS 5.3, published 2 Sep 2026) ## Vulnerabilities per week 4 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 2 | 0 | 0 | | 31 Aug 2026 | 4 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 3 | 0 | 0 | | 2 Nov 2026 | 1 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other StylemixThemes technologies - [StylemixThemes Motors – Car Dealership & Classified Listings](https://junglewise.ai/threats/technologies/motors-car-dealership-classified-listings): 9 vulnerabilities - [StylemixThemes Motors](https://junglewise.ai/threats/technologies/motors): 8 vulnerabilities - [StylemixThemes Cost Calculator Builder](https://junglewise.ai/threats/technologies/cost-calculator-builder): 3 vulnerabilities - [StylemixThemes uListing](https://junglewise.ai/threats/technologies/ulisting): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "StylemixThemes MasterStudy LMS vulnerabilities", https://junglewise.ai/threats/technologies/masterstudy-lms, 10 November 2026.