uncanny_toolkit_for_learndash vulnerabilities
CVEs whose affected-version data names the uncanny_toolkit_for_learndash package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-107127NoneUncanny Toolkit for LearnDash < 3.8.2 - Account Takeover via Password Reset CSRF
The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validate the origin of a password-reset request, allowing an unauthenticated attacker to set the password of a user who is partway through a password reset to an at…
▾ Sunlitvia CVEORG
CVE-2026-107128NoneUncanny Toolkit for LearnDash < 3.8.2 - Admin+ Cross-Site Account Lockout via Missing Authorization
The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not verify that the acting user is permitted to manage the targeted accounts before changing their verification state, allowing a subsite administrator on a multisite n…
▾ Sunlitvia CVEORG