kodezen vulnerabilities

CVEs per yearBy the year they were published

1. 20241
2. 20254
3. 202611

Newest CVEs

• CVE-2026-118800

  aBlocks <= 2.18.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'headingTag' Block Attribute

  kodezen · aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder

  Medium6.4
• CVE-2026-118801

  aBlocks <= 2.18.0 - Authenticated (Contributor+) Sensitive Information Exposure in 'ablocks_template' Shortcode

  kodezen · aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder

  Medium4.3
• CVE-2026-120544

  Academy LMS <= 4.0.1 - Authenticated (Contributor+) Arbitrary HTML File Read via 'id' Parameter in /wp/v2/templates REST Route

  kodezen · Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning

  Medium4.3
• CVE-2026-110018

  aBlocks <= 2.17.0 - Authenticated (Contributor+) Privilege Escalation to 'roleSlug' Block Attribute

  kodezen · aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder

  High8.8
• CVE-2026-104022

  Academy LMS <= 4.0.3 - Authenticated (Custom+) Privilege Escalation to add_child REST endpoint

  kodezen · Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning

  Medium5.4
• CVE-2026-104915

  Academy LMS <= 4.0.3 - Missing Authorization to Authenticated (Custom+) Arbitrary Academy Comment Deletion via delete_lesson_comment AJAX — Attacker-Controlled course_id vs. Target comment_id

  kodezen · Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning

  Medium6.5
• CVE-2026-15056

  StoreEngine <= 2.1.1 - Authenticated (Vendor+) Arbitrary File Read via Path Traversal in Downloadable File URL

  kodezen · StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More

  Medium6.5
• CVE-2026-9341

  Academy LMS <= 3.8.0 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'user_id' Parameter

  kodezen · Academy LMS

  Medium4.3
• CVE-2026-5348

  Academy LMS <= 3.8.1 - Unauthenticated Insecure Direct Object Reference to Private Topic Disclosure

  kodezen · Academy LMS – WordPress LMS Plugin for Complete eLearning Solution

  Medium5.3
• CVE-2025-15521

  Academy LMS – WordPress LMS Plugin for Complete eLearning Solution <= 3.5.0 - Unauthenticated Privilege Escalation via Account Takeover

  kodezen · Academy LMS – WordPress LMS Plugin for Complete eLearning Solution

  Critical9.8