Security
فارسی
All products

academy

WordPress · Plugin
21 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Academy LMS <= 4.0.1 - Authenticated (Contributor+) Arbitrary HTML File Read via 'id' Parameter in /wp/v2/templates REST RouteCVE-2026-120544 academy WordPress Medium Fix reported
Academy LMS <= 4.0.3 - Authenticated (Custom+) Privilege Escalation to add_child REST endpointCVE-2026-104022 academy WordPress Medium Fix reported
Academy LMS <= 4.0.3 - Missing Authorization to Authenticated (Custom+) Arbitrary Academy Comment Deletion via delete_lesson_comment AJAX — Attacker-Controlled course_id vs. Target comment_idCVE-2026-104915 academy WordPress Medium Fix reported
Academy LMS <= 3.0.0 - Authenticated (Subscriber+) Insecure Direct Object ReferenceCVE-2026-104050 academy WordPress Medium Fix reported
Academy LMS <= 3.0.0 - Authenticated (Subscriber+) Insecure Direct Object ReferenceCVE-2026-104049 academy WordPress Medium Fix reported
Academy LMS <= 3.8.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Lesson Content DisclosureCVE-2026-16563 academy WordPress Medium Fix reported
Academy LMS <= 3.8.2 - Authenticated (Subscriber+) Information ExposureCVE-2026-12376 academy WordPress Medium No fix reported
Academy LMS <= 3.8.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Note/Progress ModificationCVE-2026-14184 academy WordPress Medium Fix reported
Academy LMS <= 3.8.0 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'user_id' ParameterCVE-2026-9341 academy WordPress Medium Fix reported
Academy LMS <= 3.8.1 - Unauthenticated Insecure Direct Object Reference to Private Topic DisclosureCVE-2026-5348 academy WordPress Medium Fix reported
Academy LMS <= 3.5.3 - Missing AuthorizationCVE-2026-25372 academy WordPress Medium Fix reported
Academy LMS – WordPress LMS Plugin for Complete eLearning Solution <= 3.5.0 - Unauthenticated Privilege Escalation via Account TakeoverCVE-2025-15521 academy WordPress Critical Fix reported
Academy LMS <= 3.4.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingCVE-2025-68527 academy WordPress Medium Fix reported
Academy LMS – WordPress LMS Plugin for Complete eLearning Solution <= 3.3.8 - Authenticated (Administrator+) PHP Object Injection via 'import_all_courses'CVE-2025-12099 academy WordPress High Fix reported
Academy LMS <= 3.3.4 - Authenticated (Academy Instructor+) Insecure Direct Object ReferenceCVE-2025-59562 academy WordPress Medium Fix reported
Academy LMS <= 2.0.10 - Open RedirectCVE-2024-37234 academy WordPress High Fix reported
Academy LMS <= 2.0.4 - Missing AuthorizationCVE-2024-38701 academy WordPress Low Fix reported
Academy LMS <= 1.9.25 - Unauthenticated Sensitive Information ExposureCVE-2024-35171 academy WordPress Medium Fix reported
Academy LMS <= 1.9.16 - Missing AuthorizationCVE-2024-33912 academy WordPress Medium Fix reported
Academy LMS <= 1.9.16 - Missing AuthorizationCVE-2024-32714 academy WordPress Medium Fix reported