Kodezen Academy Lms vulnerabilities

• kodezen academy lms – ai course builder, quizzes, certificates & elearning Academy LMS <= 4.0.1 - Authenticated (Contributor+) Arbitrary HTML File Read via 'id' Parameter in /wp/v2/templates REST Route CVE-2026-120544 4.3 MediumNovember 3, 2026
• kodezen academy lms – ai course builder, quizzes, certificates & elearning Academy LMS <= 4.0.3 - Authenticated (Custom+) Privilege Escalation to add_child REST endpoint CVE-2026-104022 5.4 MediumOctober 10, 2026
• kodezen academy lms – ai course builder, quizzes, certificates & elearning Academy LMS <= 4.0.3 - Missing Authorization to Authenticated (Custom+) Arbitrary Academy Comment Deletion via delete_lesson_comment AJAX — Attacker-Controlled course_id vs. Target comment_id CVE-2026-104915 6.5 MediumOctober 10, 2026
• kodezen academy lms Academy LMS <= 3.8.0 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'user_id' Parameter CVE-2026-9341 4.3 MediumJuly 14, 2026
• kodezen academy lms – wordpress lms plugin for complete elearning solution Academy LMS <= 3.8.1 - Unauthenticated Insecure Direct Object Reference to Private Topic Disclosure CVE-2026-5348 5.3 MediumJuly 2, 2026
• kodezen academy lms – wordpress lms plugin for complete elearning solution Academy LMS – WordPress LMS Plugin for Complete eLearning Solution <= 3.5.0 - Unauthenticated Privilege Escalation via Account Takeover CVE-2025-15521 Public exploit 9.8 CriticalJanuary 21, 2026
• kodezen academy lms – wordpress lms plugin for complete elearning solution Academy LMS – WordPress LMS Plugin for Complete eLearning Solution <= 3.3.8 - Authenticated (Administrator+) PHP Object Injection via 'import_all_courses' CVE-2025-12099 7.2 HighNovember 8, 2025
• kodezen academy lms, academy lms – wordpress lms plugin for complete elearning solution +1 more Academy LMS – eLearning and online course solution for WordPress <= 1.9.19 - Authenticated (Subscriber+) Privilege Escalation CVE-2024-1505 8.8 HighMarch 13, 2024