Veille CVE

Recherche « Designthemes LMS »

4 CVE

Critique 0 Élevée 2 Moyenne 1 Faible 0 Non évaluée 1 Exploitées (KEV) Tri : plus récentes « Designthemes LMS » ✕
  1. CVE-2026-78532 7.1 Élevée

    designthemes LMS

    Unauthenticated Cross Site Scripting (XSS) in LMS <= 8.3 versions.

  2. CVE-2026-11355 5.3 Moyenne

    designthemes DT LMS – elearning, WordPress LMS Plugin

    The DT LMS – elearning, WordPress LMS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX handlers (including dtlms_save_poc_settings, dtlms_save_skin_settings, and dtlms_save_options_settings) in versions up to, and including, 1.1. These handlers are registered on the wp_ajax_nopriv_* hook and contain no capability check, no nonce verification, and pass user-supplied data directly to update_option(). This makes it possible for unauthenticated attackers to overwrite arbitrary plugin option values stored in the wp_options table, including Point-of-Contact email configuration and skin/branding settings, which can be used to alter the appearance and behavior of the LMS for all site visitors.

  3. CVE-2025-13398 – Non évaluée Rejetée

    Rejected reason: This CVE ID is a duplicate of CVE-2025-13542 and was never published. Both IDs were assigned to the same unauthenticated privilege escalation vulnerability in the DesignThemes LMS WordPress plugin. All CVE users should reference CVE-2025-13542 instead of this ID.

  4. CVE-2026-27404 7.1 Élevée

    Designthemes LMS

    Unauthenticated Cross Site Scripting (XSS) in LMS <= 9.7 versions.