kodezen vulnerabilities

CVEs per yearBy the year they were published

1. 20241
2. 20254
3. 20269

Newest CVEs

• CVE-2026-120544

  Academy LMS <= 4.0.1 - Authenticated (Contributor+) Arbitrary HTML File Read via 'id' Parameter in /wp/v2/templates REST Route

  kodezen · Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning

  Medium4.3
• CVE-2026-110018

  aBlocks <= 2.17.0 - Authenticated (Contributor+) Privilege Escalation to 'roleSlug' Block Attribute

  kodezen · aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder

  High8.8
• CVE-2026-104022

  Academy LMS <= 4.0.3 - Authenticated (Custom+) Privilege Escalation to add_child REST endpoint

  kodezen · Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning

  Medium5.4
• CVE-2026-104915

  Academy LMS <= 4.0.3 - Missing Authorization to Authenticated (Custom+) Arbitrary Academy Comment Deletion via delete_lesson_comment AJAX — Attacker-Controlled course_id vs. Target comment_id

  kodezen · Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning

  Medium6.5
• CVE-2026-15056

  StoreEngine <= 2.1.1 - Authenticated (Vendor+) Arbitrary File Read via Path Traversal in Downloadable File URL

  kodezen · StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More

  Medium6.5
• CVE-2026-9341

  Academy LMS <= 3.8.0 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'user_id' Parameter

  kodezen · Academy LMS

  Medium4.3
• CVE-2026-5348

  Academy LMS <= 3.8.1 - Unauthenticated Insecure Direct Object Reference to Private Topic Disclosure

  kodezen · Academy LMS – WordPress LMS Plugin for Complete eLearning Solution

  Medium5.3
• CVE-2025-15521

  Academy LMS – WordPress LMS Plugin for Complete eLearning Solution <= 3.5.0 - Unauthenticated Privilege Escalation via Account Takeover

  kodezen · Academy LMS – WordPress LMS Plugin for Complete eLearning Solution

  Critical9.8
• CVE-2025-12449

  aBlocks – WordPress Gutenberg Blocks <= 2.4.0 - Missing Authorization to Authenticated (Subscriber+) Settings Modification

  kodezen · aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder

  Medium5.4
• CVE-2025-12099

  Academy LMS – WordPress LMS Plugin for Complete eLearning Solution <= 3.3.8 - Authenticated (Administrator+) PHP Object Injection via 'import_all_courses'

  kodezen · Academy LMS – WordPress LMS Plugin for Complete eLearning Solution

  High7.2