Mojoomla vulnerabilities
Published CVEs affecting Mojoomla products: 6 record(s), with severity, exploitation and fixes.
CVE-2025-15657
Medium · 5.3
CWE-639 Jun 17, 2026
WordPress School Management plugin <= 93.1.0 - Insecure Direct Object References (IDOR) vulnerability
Unauthenticated Insecure Direct Object References (IDOR) in School Management <= 93.1.0 versions.
CVE-2026-39433
Medium · 6.5
CWE-862 Jun 17, 2026
WordPress WPAMS plugin < 49.5.3 - Arbitrary Content Deletion vulnerability
Subscriber Arbitrary Content Deletion in WPAMS < 49.5.3 versions.
CVE-2025-15656
High · 8.8
CWE-266 Jun 3, 2026
WordPress School Management plugin <= 93.2.0 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in Mojoomla School Management allows Privilege Escalation.
This issue affects School Management: from n/a through 93.2.0.
CVE-2025-15655
High · 7.6
CWE-89 Jun 3, 2026
WordPress School Management plugin <= 93.2.0 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mojoomla School Management allows SQL Injection.
This issue affects School Management: from n/a through 93.2.0.
CVE-2025-32303
Critical · 9.3
CWE-89 Jan 7, 2026
WordPress WPCHURCH plugin <= 2.7.0 - SQL Injection Vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mojoomla WPCHURCH allows Blind SQL Injection.This issue affects WPCHURCH: from n/a through 2.7.0.
CVE-2025-32304
High · 8.1
CWE-98 Jan 6, 2026
WordPress WPCHURCH plugin <= 2.7.0 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mojoomla WPCHURCH allows PHP Local File Inclusion.This issue affects WPCHURCH: from n/a through 2.7.0.