CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2024-7786 – Sensei LMS < 4.24.2 - Unauthenticated Email Template Leak
https://notcve.org/view.php?id=CVE-2024-7786
14 Aug 2024 — The Sensei LMS WordPress plugin before 4.24.2 does not properly protect some its REST API routes, allowing unauthenticated attackers to leak email templates. The Sensei LMS – Online Courses, Quizzes, & Learning plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.24.1 via the /v2/sensei_email/ REST API endpoint due to a missing capability check. This makes it possible for unauthenticated attackers to extract data from email templates. • https://wpscan.com/vulnerability/f44e6f8f-3ef2-45c9-ae9c-9403305a548a • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-35686 – WordPress Sensei LMS plugin <= 4.23.1 - Broken Access Control vulnerability
https://notcve.org/view.php?id=CVE-2024-35686
06 Jun 2024 — Missing Authorization vulnerability in Automattic Sensei LMS, Automattic Sensei Pro (WC Paid Courses).This issue affects Sensei LMS: from n/a through 4.23.1; Sensei Pro (WC Paid Courses): from n/a through 4.23.1.1.23.1. The Sensei LMS and Sensei Pro (WC Paid Courses) plugins for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the flush_rewrite_rules() function in versions up to, and including, 4.23.1 and . 4.24.0.1.24.0 respectively. This makes it possible f... • https://patchstack.com/database/vulnerability/sensei-lms/wordpress-sensei-lms-plugin-4-23-1-broken-access-control-vulnerability?_s_id=cve • CWE-862: Missing Authorization •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-50875 – WordPress Sensei LMS Plugin <= 4.17.0 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2023-50875
22 Dec 2023 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic Sensei LMS – Online Courses, Quizzes, & Learning allows Stored XSS.This issue affects Sensei LMS – Online Courses, Quizzes, & Learning: from n/a through 4.17.0. La neutralización inadecuada de la entrada durante la vulnerabilidad de generación de páginas web ('Cross-site Scripting') en Automattic Sensei LMS – Online Courses, Quizzes, & Learning permite almacenar XSS. Este problema afecta a Se... • https://patchstack.com/database/vulnerability/sensei-lms/wordpress-sensei-lms-plugin-4-17-0-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 2CVE-2022-2034 – Sensei LMS < 4.5.0 - Unauthenticated Private Messages Disclosure via Rest API
https://notcve.org/view.php?id=CVE-2022-2034
04 Aug 2022 — The Sensei LMS WordPress plugin before 4.5.0 does not have proper permissions set in one of its REST endpoint, allowing unauthenticated users to access private messages sent to teachers El plugin Sensei LMS de WordPress versiones anteriores a 4.5.0, no presenta los permisos apropiados establecidos en uno de sus endpoints REST, lo que permite a usuarios no autenticados acceder a los mensajes privados enviados a los profesores The Sensei LMS plugin for WordPress is vulnerable to Sensitive Data Exposure in ver... • https://hackerone.com/reports/1590237 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2022-2080 – Sensei LMS < 4.5.2 - Arbitrary Private Message Sending via IDOR
https://notcve.org/view.php?id=CVE-2022-2080
04 Aug 2022 — The Sensei LMS WordPress plugin before 4.5.2 does not ensure that the sender of a private message is either the teacher or the original sender, allowing any authenticated user to send messages to arbitrary private conversation via a IDOR attack. Note: Attackers are not able to see responses/messages between the teacher and student El plugin Sensei LMS de WordPress versiones anteriores a 4.5.2, no asegura que el remitente de un mensaje privado sea el profesor o el remitente original, permitiendo que cualquie... • https://hackerone.com/reports/1592596 • CWE-639: Authorization Bypass Through User-Controlled Key CWE-862: Missing Authorization •