uncanny_toolkit_for_learndash vulnerabilities
CVEs whose affected-version data names the uncanny_toolkit_for_learndash package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-107127High· 7.5Uncanny Toolkit for LearnDash < 3.8.2 - Account Takeover via Password Reset CSRF
The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validate the origin of a password-reset request, allowing an unauthenticated attacker to set the password of a user who is partway through a password reset to an at…
▾ TwilightEPSS 0.17%via CVEORG
CVE-2026-107128Medium· 5.0Uncanny Toolkit for LearnDash < 3.8.2 - Admin+ Cross-Site Account Lockout via Missing Authorization
The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not verify that the acting user is permitted to manage the targeted accounts before changing their verification state, allowing a subsite administrator on a multisite n…
▾ SunlitEPSS 0.28%via CVEORG