Kodezen vulnerabilities

Products

• Academy Lms 5
• Academy Lms – Wordpress Lms Plugin For Complete Elearning Solution 4
• Ablocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder 3
• Academy Lms – Ai Course Builder, Quizzes, Certificates & Elearning 3
• Storeengine — Complete Ecommerce Solution With Memberships, Licensing, Affiliates & More 3

Newest

• kodezen ablocks – gutenberg blocks, user dashboard builder, popup builder, form builder & animation builder aBlocks <= 2.18.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'headingTag' Block Attribute CVE-2026-118800 6.4 MediumNovember 7, 2026
• kodezen ablocks – gutenberg blocks, user dashboard builder, popup builder, form builder & animation builder aBlocks <= 2.18.0 - Authenticated (Contributor+) Sensitive Information Exposure in 'ablocks_template' Shortcode CVE-2026-118801 4.3 MediumNovember 7, 2026
• kodezen academy lms – ai course builder, quizzes, certificates & elearning Academy LMS <= 4.0.1 - Authenticated (Contributor+) Arbitrary HTML File Read via 'id' Parameter in /wp/v2/templates REST Route CVE-2026-120544 4.3 MediumNovember 3, 2026
• kodezen ablocks – gutenberg blocks, user dashboard builder, popup builder, form builder & animation builder aBlocks <= 2.17.0 - Authenticated (Contributor+) Privilege Escalation to 'roleSlug' Block Attribute CVE-2026-110018 8.8 HighOctober 24, 2026
• kodezen academy lms – ai course builder, quizzes, certificates & elearning Academy LMS <= 4.0.3 - Authenticated (Custom+) Privilege Escalation to add_child REST endpoint CVE-2026-104022 5.4 MediumOctober 10, 2026
• kodezen academy lms – ai course builder, quizzes, certificates & elearning Academy LMS <= 4.0.3 - Missing Authorization to Authenticated (Custom+) Arbitrary Academy Comment Deletion via delete_lesson_comment AJAX — Attacker-Controlled course_id vs. Target comment_id CVE-2026-104915 6.5 MediumOctober 10, 2026
• kodezen storeengine — complete ecommerce solution with memberships, licensing, affiliates & more StoreEngine <= 2.1.1 - Authenticated (Vendor+) Arbitrary File Read via Path Traversal in Downloadable File URL CVE-2026-15056 6.5 MediumAugust 16, 2026
• kodezen academy lms Academy LMS <= 3.8.0 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'user_id' Parameter CVE-2026-9341 4.3 MediumJuly 14, 2026
• kodezen academy lms – wordpress lms plugin for complete elearning solution Academy LMS <= 3.8.1 - Unauthenticated Insecure Direct Object Reference to Private Topic Disclosure CVE-2026-5348 5.3 MediumJuly 2, 2026
• kodezen academy lms – wordpress lms plugin for complete elearning solution Academy LMS – WordPress LMS Plugin for Complete eLearning Solution <= 3.5.0 - Unauthenticated Privilege Escalation via Account Takeover CVE-2025-15521 Public exploit 9.8 CriticalJanuary 21, 2026
• kodezen ablocks – gutenberg blocks, user dashboard builder, popup builder, form builder & animation builder aBlocks – WordPress Gutenberg Blocks <= 2.4.0 - Missing Authorization to Authenticated (Subscriber+) Settings Modification CVE-2025-12449 5.4 MediumJanuary 7, 2026
• kodezen academy lms – wordpress lms plugin for complete elearning solution Academy LMS – WordPress LMS Plugin for Complete eLearning Solution <= 3.3.8 - Authenticated (Administrator+) PHP Object Injection via 'import_all_courses' CVE-2025-12099 7.2 HighNovember 8, 2025
• kodezen storeengine — complete ecommerce solution with memberships, licensing, affiliates & more StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More <= 1.5.0 - Authenticated (Subscriber+) Arbitrary File Upload CVE-2025-9216 Public exploit 8.8 HighSeptember 17, 2025
• kodezen storeengine — complete ecommerce solution with memberships, licensing, affiliates & more StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More <= 1.5.0 - Authenticated (Subscriber+) Arbitrary File Download CVE-2025-9215 Public exploit 6.5 MediumSeptember 17, 2025
• tusharimran ablocks, kodezen ablocks – gutenberg blocks, user dashboard builder, popup builder, form builder & animation builder +1 more aBlocks – WordPress Gutenberg Blocks <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2024-13465 6.4 MediumFebruary 18, 2025
• academy lms lms, kodezen academy lms +1 more WordPress Academy LMS plugin <= 2.0.4 - Broken Access Control vulnerability CVE-2024-38701 4.3 MediumJuly 22, 2024
• academy lms lms, kodezen academy lms +1 more WordPress Academy LMS plugin <= 1.9.16 - Broken Access Control vulnerability CVE-2024-32714 4.3 MediumJune 9, 2024
• academy lms lms, kodezen academy lms +1 more WordPress Academy LMS plugin <= 1.9.25 - Sensitive Data Exposure vulnerability CVE-2024-35171 5.3 MediumMay 13, 2024
• academy lms lms, kodezen academy lms +1 more WordPress Academy LMS plugin <= 1.9.16 - Broken Access Control on Paid Courses vulnerability CVE-2024-33912 7.1 HighMay 6, 2024
• kodezen academy lms, academy lms – wordpress lms plugin for complete elearning solution +1 more Academy LMS – eLearning and online course solution for WordPress <= 1.9.19 - Authenticated (Subscriber+) Privilege Escalation CVE-2024-1505 8.8 HighMarch 13, 2024