MasterStudy LMS WordPress Plugin – for Online Courses and Education

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.

wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.

211 searches this plugin appeared in over the last 90 days, 20 listed. 164 left out as unrelated or noise (years, numbers, stray words).

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 70% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Crossed into this band 6.1 years ago; a band this size takes about a year or more to cross, which places it about 90% of the way through.

1. ★★★★★ rauljoselito

   4mo ago

   We are a church and non-profit organization, and MasterStudy LMS has been a fantastic solution for us. The plugin offers a wide range of features that make it easy to create and manage online courses, even for a small team with limited technical experience. We especially appreciate the clean course builder, flexible lesson formats (video, quizzes, assignments, etc.), student management tools, and the ability to offer free or paid courses. It has helped us deliver Bible studies, training programs, and discipleship courses to our congregation and online community in a professional yet easy-to-use way. The mobile-friendly design is also a big plus for our members. Setup was straightforward, documentation is helpful, and the support team has been responsive when we’ve had questions. For any church, ministry, or non-profit looking for a powerful yet affordable LMS, I highly recommend MasterStudy LMS.

   Read on wp.org ↗
2. ★★★★★ fcassou

   4mo ago

   Very interesting plugin with audio integration!

   Read on wp.org ↗
3. ★★★★★ bonigantile

   5mo ago

   Works very well

   Read on wp.org ↗
4. ★★★★★ jhaaloky2k

   6mo ago

   I am satisfied with customer support. also working smooth on wordpress site.

   Read on wp.org ↗
5. ★★★★★ bmde

   6mo ago

   I’ve been using your plugins for over two years now especially Cost Calculator in my parking reservation and international package delivery businesses, and I love the technology and simplicity you’ve built into these tools. I encourage you to take it even further and create, for example, an accommodation booking tool like one for booking a hotel for someone who wants to build a site similar to Airbnb or Booking.com. That would help a lot of people expand their businesses. In any case, I love your work and the responsiveness of your customer service team, who are always ready to help and respond very quickly.

   Read on wp.org ↗
6. ★★★★★ psycopyme

   6mo ago

   Llevo años utilizando MasterStudy y la verdad me ha gustado mucho. A diferencia de otros LMS que he probado para WordPress, este me ha dejado fascinado: No te rompe páginas, es sencillo de entender y utilizar, su documentación ayuda mucho, escuchan a su comunidad y lo mejor es que actualizan seguido. ¡Bien por este sistema!

   Read on wp.org ↗
7. ★★★★★ wathiqoon

   6mo ago

   Outstanding support and various features that meet all your LMS needs.

   Read on wp.org ↗
8. ★★★★★ mrewbie65812

   6mo ago

   Thanks Bill for your super prompt and informative support MS Pro Plus isn’t the most intuitive plugin around and sometimes the help files are outdated. All the more important that tech support is up to date and available —a BIG improvement compared with when I first started with MasterStudy!

   Read on wp.org ↗

Recent releases and news for this plugin

1. 2026-10-30 Version 3.7.57 Fix: Fixed a Broken Access Control that allowed any logged-in user to retrieve media attachment URLs through an AJAX endpoint. Fix: Fixed an issue where shortcodes inside course reviews could be executed on render. 3.7.57
2. 2026-10-27 Version 3.7.56 New: Added the Students limit setting to the Course Builder (Settings → Access) to cap the number of students who can enroll in a course [PRO]. Fix: Fixed the main menu being hidden in an OceanWP header built with Elemen 3.7.56
3. 2026-10-19 Version 3.7.55 Update: Shared certificate links, QR codes and certificate emails now use a unique certificate code instead of the student ID [PRO]. Update: Improved Matching, Image Matching and Keywords questions generated by AI Lab [P 3.7.55
4. 2026-09-23 Version 3.7.52 Fix: Fixed LMS Form Builder custom fields not being available in Email Manager registration templates [PRO]. Fix: Fixed the Group Course student limit setting not being applied correctly [PRO]. Fix: Fixed formatted Quiz 3.7.52
5. 2026-09-21 Version 3.7.51 New: Added Quick Links to the top admin bar for MasterStudy plugin pages. Fix: Fixed PDF Lesson rendering issues for Latin characters when Arabic (RTL) text is present. Fix: Fixed hover notification display for Instructo 3.7.51
6. 2026-09-15 Version 3.7.50 Fix: Added hardening and authorization fixes for reported issues. Fix: Fixed instructor order status [PRO]. Fix: Fixed an _load_textdomain_just_in_time notices. Fix: Fixed the Courses admin page not loading when the site 3.7.50

All 55 disclosed vulnerabilities are patched in the current version (3.7.57). Sites still on an older version should update.

1. Patched Medium · 4.3 MasterStudy LMS WordPress Plugin – for Online Courses and Education 3.7.13 - 3.7.54 - Missing Authorization ↗
   2026-10-22 CVE-2026-88849 Missing Authorization Affects 3.7.13 - 3.7.54 Patched in 3.7.55
2. Patched Medium · 6.4 MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.52 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
   2026-10-08 CVE-2026-105079 Improper Neutralization of Input During Web Page Generation Affects <= 3.7.52 Patched in 3.7.53
3. Patched High · 7.5 MasterStudy LMS 3.5.29 - 3.7.49 - Authenticated (Contributor+) Local File Inclusion ↗
   2026-09-25 CVE-2026-88843 Improper Limitation of a Pathname to a Restricted Directory Affects 3.5.29 - 3.7.49 Patched in 3.7.50
4. Patched Medium · 4.3 MasterStudy LMS <= 3.7.49 - Missing Authorization ↗
   2026-09-22 CVE-2026-88845 Missing Authorization Affects <= 3.7.49 Patched in 3.7.50
5. Patched Medium · 5.3 MasterStudy LMS <= 3.7.49 - Missing Authorization to Account Registration ↗
   2026-09-22 CVE-2026-88846 Missing Authorization Affects <= 3.7.49 Patched in 3.7.50
6. Patched Medium · 4.3 MasterStudy LMS <= 3.7.49 - Missing Authorization ↗
   2026-09-22 CVE-2026-88847 Missing Authorization Affects <= 3.7.49 Patched in 3.7.50
7. Patched Medium · 4.3 MasterStudy LMS <= 3.7.49 - Unauthenticated (Subscriber+) Unauthorized Course Enrollment ↗
   2026-09-22 CVE-2026-88848 Client-Side Enforcement of Server-Side Security Affects <= 3.7.49 Patched in 3.7.50
8. Patched Medium · 4.3 MasterStudy LMS <= 3.7.49 - Authenticated (Subscriber+) Insecure Direct Object Reference ↗
   2026-09-21 CVE-2026-81339 Authorization Bypass Through User-Controlled Key Affects <= 3.7.49 Patched in 3.7.50
9. Patched Medium · 6.3 MasterStudy LMS <= 3.7.49 - Authenticated (Subscriber+) HTML Injection ↗
   2026-09-21 CVE-2026-81338 Improper Input Validation Affects <= 3.7.49 Patched in 3.7.50
10. Patched Medium · 4.3 MasterStudy LMS <= 3.7.49 - Authenticated (Instructor+) Insecure Direct Object Reference ↗
    2026-09-16 CVE-2026-88844 Authorization Bypass Through User-Controlled Key Affects <= 3.7.49 Patched in 3.7.50
11. Patched Medium · 4.3 MasterStudy LMS <= 3.7.49 - Authenticated (Instructor+) Insecure Direct Object Reference ↗
    2026-09-16 CVE-2026-81340 Authorization Bypass Through User-Controlled Key Affects <= 3.7.49 Patched in 3.7.50
12. Patched Medium · 4.3 MasterStudy LMS WordPress Plugin – for Online Courses and Education < 3.7.46 - Authenticated (Subscriber+) Insecure Direct Object Reference ↗
    2026-09-02 CVE-2026-81194 Authorization Bypass Through User-Controlled Key Affects < 3.7.46 Patched in 3.7.46
13. Patched Medium · 5.3 MasterStudy LMS WordPress Plugin – for Online Courses and Education < 3.7.46 - Unauthenticated Information Exposure ↗
    2026-09-02 CVE-2026-81199 Exposure of Sensitive Information to an Unauthorized Actor Affects < 3.7.46 Patched in 3.7.46
14. Patched Medium · 4.3 MasterStudy LMS WordPress Plugin – for Online Courses and Education < 3.7.46 - Authenticated (Custom Role+) Insecure Direct Object Reference ↗
    2026-09-02 CVE-2026-81196 Authorization Bypass Through User-Controlled Key Affects < 3.7.46 Patched in 3.7.46
15. Patched Medium · 5.3 MasterStudy LMS WordPress Plugin – for Online Courses and Education < 3.7.46 - Missing Authorization ↗
    2026-09-02 CVE-2026-81195 Missing Authorization Affects < 3.7.46 Patched in 3.7.46
16. Patched Medium · 4.3 MasterStudy LMS WordPress Plugin – for Online Courses and Education < 3.7.46 - Authenticated (Custom Role+) Insecure Direct Object Reference ↗
    2026-09-02 CVE-2026-81198 Authorization Bypass Through User-Controlled Key Affects < 3.7.46 Patched in 3.7.46
17. Patched Medium · 5.3 MasterStudy LMS WordPress Plugin – for Online Courses and Education < 3.7.46 - Unauthenticated Unpublished Course Data Exposure ↗
    2026-08-31 CVE-2026-81197 Exposure of Sensitive Information to an Unauthorized Actor Affects < 3.7.46 Patched in 3.7.46
18. Patched Medium · 4.3 MasterStudy LMS WordPress Plugin – for Online Courses and Education < 3.7.42 - Authenticated (Custom Role+) Insecure Direct Object Reference ↗
    2026-08-29 CVE-2026-81200 Authorization Bypass Through User-Controlled Key Affects < 3.7.42 Patched in 3.7.42
19. Patched High · 7.2 MasterStudy LMS WordPress Plugin – for Online Courses and Education < 3.7.43 - Unauthenticated Open Redirect ↗
    2026-08-27 CVE-2026-81342 URL Redirection to Untrusted Site Affects < 3.7.43 Patched in 3.7.43
20. Patched Medium · 5.3 MasterStudy LMS WordPress Plugin – for Online Courses and Education < 3.7.40 - Unauthenticated Payment Bypass ↗
    2026-08-27 CVE-2026-81026 Client-Side Enforcement of Server-Side Security Affects < 3.7.40 Patched in 3.7.40
21. Patched Critical · 9.1 MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.42 - Unauthenticated Arbitrary File Deletion ↗
    2026-08-24 CVE-2026-78284 Improper Limitation of a Pathname to a Restricted Directory Affects <= 3.7.42 Patched in 3.7.43
22. Patched Medium · 6.3 MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.41 - Authenticated (Subscriber+) Privilege Escalation ↗
    2026-08-18 CVE-2026-68568 Improper Privilege Management Affects <= 3.7.41 Patched in 3.7.42
23. Patched Medium · 4.3 MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.41 - Missing Authorization ↗
    2026-08-18 CVE-2026-73404 Missing Authorization Affects <= 3.7.41 Patched in 3.7.42
24. Patched Medium · 5.3 MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.39 - Missing Authorization ↗
    2026-07-31 CVE-2026-28145 Missing Authorization Affects <= 3.7.39 Patched in 3.7.40
25. Patched Medium · 6.5 MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.14 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Attachment Deletion ↗
    2026-07-28 CVE-2026-5060 Authorization Bypass Through User-Controlled Key Affects <= 3.7.23 Patched in 3.7.24
26. Patched Medium · 6.4 MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.27 - Authenticated (Subscriber+) Stored Cross-Site Scripting ↗
    2026-06-29 CVE-2026-57330 Improper Neutralization of Input During Web Page Generation Affects <= 3.7.27 Patched in 3.7.28
27. Patched Medium · 4.3 MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.30 - Missing Authorization ↗
    2026-06-26 CVE-2026-57640 Missing Authorization Affects <= 3.7.30 Patched in 3.7.31
28. Patched Medium · 6.5 MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.29 - Authenticated (Subscriber+) SQL Injection ↗
    2026-05-24 CVE-2026-42730 Improper Neutralization of Special Elements used in an SQL Command Affects <= 3.7.29 Patched in 3.7.30
29. Patched Medium · 6.5 MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.25 - Authenticated (Subscriber+) SQL Injection ↗
    2026-04-21 CVE-2026-40766 Improper Neutralization of Special Elements used in an SQL Command Affects <= 3.7.25 Patched in 3.7.26
30. Patched Medium · 6.5 MasterStudy LMS <= 3.7.25 - Authenticated (Subscriber+) Time-based Blind SQL Injection via 'order' and 'orderby' Parameters ↗
    2026-04-16 CVE-2026-4817 Improper Neutralization of Special Elements used in an SQL Command Affects <= 3.7.25 Patched in 3.7.26
31. Patched Medium · 6.4 MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'stm_lms_courses_grid_display' Shortcode ↗
    2026-02-13 CVE-2026-0559 Improper Neutralization of Input During Web Page Generation Affects <= 3.7.11 Patched in 3.7.12
32. Patched Medium · 5.4 MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.6 Missing Authorization to Authenticated (Subscriber+) Posts and Media Creation, Modification and Deletion ↗
    2026-01-05 CVE-2025-13766 Missing Authorization Affects <= 3.7.6 Patched in 3.7.7
33. Patched Medium · 6.5 MasterStudy LMS <= 3.6.27 - Authenticated (Instructor+) SQL Injection ↗
    2025-10-23 CVE-2025-64366 Improper Neutralization of Special Elements used in an SQL Command Affects <= 3.6.27 Patched in 3.6.28
34. Patched Medium · 4.3 MasterStudy LMS <= 3.6.20 - Authenticated (Instructor+) Sensitive Information Exposure ↗
    2025-10-16 CVE-2025-59575 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 3.6.20 Patched in 3.6.21
35. Patched Medium · 4.3 MasterStudy LMS <= 3.6.20 - Authenticated (Subscriber+) Race Condition to Multiple Reviews ↗
    2025-09-22 CVE-2025-59577 Concurrent Execution using Shared Resource with Improper Synchronization Affects <= 3.6.20 Patched in 3.6.21
36. Patched Medium · 4.3 MasterStudy LMS <= 3.6.20 - Missing Authorization ↗
    2025-09-22 CVE-2025-59576 Missing Authorization Affects <= 3.6.20 Patched in 3.6.21
37. Patched Medium · 4.3 MasterStudy LMS <= 3.6.15 - Missing Authorization ↗
    2025-09-03 CVE-2025-54744 Missing Authorization Affects <= 3.6.15 Patched in 3.6.16
38. Patched High · 8.8 MasterStudy LMS <= 3.5.28 - Authenticated (Contributor+) Local File Inclusion ↗
    2025-04-04 CVE-2025-32141 Improper Control of Filename for Include/Require Statement in PHP Program Affects <= 3.5.28 Patched in 3.5.29
39. Patched Medium · 4.3 MasterStudy LMS <= 3.5.28 - Missing Authorization ↗
    2025-04-04 CVE-2025-32237 Missing Authorization Affects <= 3.5.28 Patched in 3.5.29
40. Patched High · 7.3 MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.3.23 - Unauthenticated Limited Privilege Escalation to Instructor ↗
    2024-07-01 CVE-2024-5973 Improper Privilege Management Affects <= 3.3.23 Patched in 3.3.24
41. Patched Medium · 5.3 MasterStudy LMS <= 3.2.12 - Missing Authorization ↗
    2024-06-20 CVE-2024-37094 Missing Authorization Affects <= 3.2.12 Patched in 3.2.13
42. Patched Medium · 4.3 MasterStudy LMS <= 3.2.1 - Cross-Site Request Forgery ↗
    2024-06-20 CVE-2024-37093 Cross-Site Request Forgery Affects <= 3.2.1 Patched in 3.2.2
43. Patched Medium · 6.3 MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.3.8 - Missing Authorization ↗
    2024-04-29 CVE-2024-3942 Missing Authorization Affects <= 3.3.8 Patched in 3.3.9
44. Patched Critical · 9.8 MasterStudy LMS <= 3.3.3 - Unauthenticated Local File Inclusion via template ↗
    2024-04-04 CVE-2024-3136 Improper Control of Filename for Include/Require Statement in PHP Program Affects <= 3.3.3 Patched in 3.3.4
45. Patched Critical · 9.8 MasterStudy LMS <= 3.3.1 - Unauthenticated Privilege Escalation via stm_lms_register AJAX Action ↗
    2024-03-28 CVE-2024-2409 Incorrect Privilege Assignment Affects <= 3.3.1 Patched in 3.3.2
46. Patched Critical · 9.8 MasterStudy LMS <= 3.3.0 - Unauthenticated Local File Inclusion via modal ↗
    2024-03-28 CVE-2024-2411 Improper Control of Filename for Include/Require Statement in PHP Program Affects <= 3.3.0 Patched in 3.3.1
47. Patched Medium · 4.3 MasterStudy LMS <= 3.2.13 - Missing Authorization to Sensitive Information Exposure in search_posts ↗
    2024-03-15 CVE-2024-1904 Missing Authorization Affects <= 3.2.13 Patched in 3.3.0
48. Patched Medium · 5.3 MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.2.10 - Basic Information Exposure via REST route ↗
    2024-03-06 CVE-2024-2106 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 3.2.10 Patched in 3.2.11
49. Patched Critical · 9.8 MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.2.5 - Unauthenticated SQL Injection ↗
    2024-02-16 CVE-2024-1512 Improper Neutralization of Special Elements used in an SQL Command Affects <= 3.2.5 Patched in 3.2.6
50. Patched High · 7.3 MasterStudy LMS <= 3.0.17 - Privilege Escalation ↗
    2023-08-21 CVE-2023-4278 Improper Privilege Management Affects <= 3.0.17 Patched in 3.0.18
51. Patched Medium · 6.1 Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get ↗
    2023-07-18 CVE-2023-33999 Improper Neutralization of Input During Web Page Generation Affects <= 2.7.9 Patched in 2.8.0
52. Patched Medium · 6.4 MasterStudy LMS <= 3.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2023-06-15 CVE-2023-35090 Improper Neutralization of Input During Web Page Generation Affects <= 3.0.8 Patched in 3.0.9
53. Patched Medium · 4.3 MasterStudy LMS <= 3.0.8 - Missing Authorization to Course Category Creation ↗
    2023-06-15 CVE-2023-35093 Missing Authorization Affects <= 3.0.8 Patched in 3.0.9
54. Patched Medium · 4.3 MasterStudy LMS WordPress Plugin <= 2.9.34 - Missing Authorization via wp_ajax_stm_wpcfto_get_settings ↗
    2023-04-03 Missing Authorization Affects <= 2.9.34 Patched in 2.9.35
55. Patched Critical · 9.8 MasterStudy LMS < 2.7.6 - Unauthenticated Admin Account Creation ↗
    2022-02-01 CVE-2022-0441 Improper Privilege Management Affects <= 2.7.5 Patched in 2.7.6

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0

Translated into 29 languages, 0 at 90% or more

Plus 5 more locales with partial translations.

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Not measured yet for this plugin’s topics. Its tracked searches are not among the measured topics. See the topics measured so far.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2020-09-29 8K+ → 10K+ up after 112 days in tier
2. 2020-06-09 6K+ → 8K+ up after 47 days in tier
3. 2020-04-23 2K+ → 6K+ up

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for MasterStudy LMS WordPress Plugin – for Online Courses and Education into a readme, a review or a deck. It updates itself.

MasterStudy LMS WordPress Plugin – for Online Courses and Education: 10K+ active installs, 4.5★ (487 reviews). Plugin Pulse (WP Mayor), as of 2026-11-01. https://plugins.wpmayor.com/plugin/masterstudy-lms-learning-management-system