LE
Product
LearnPress
58
CVEs
0
On KEV
9.8
Max CVSS
8
New 30D
Severity mix
Critical 6High 16Medium 36Low 0
Watch
Add LearnPress to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-36515 | 9.8 | Jun 19 | Missing Authorization vulnerability in ThimPress LearnPress.This issue affects LearnPress: from n/a through 4.2.3 Affected: before 4.2.3.1 |
| CVE-2024-4434 | 9.8 | May 14 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the ‘term_id’ parameter in versions up to, and including, 4.2.6.5 due to… Affected: before 4.2.6.6 |
| CVE-2023-6634 | 9.8 | Jan 11 | The LearnPress plugin for WordPress is vulnerable to Command Injection in all versions up to, and including, 4.2.5.7 via the get_content function Affected: through 4.2.5.7 |
| CVE-2022-47615 | 9.8 | Jan 26 | Local File Inclusion vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions Affected: before 4.2.0 |
| CVE-2022-45808 | 9.8 | Jan 26 | SQL Injection vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions Affected: through 4.1.7.3.2 |
| CVE-2021-24951 | 9.8 | Dec 13 | The LearnPress WordPress plugin before 4.1.4 does not sanitise, validate and escape the id parameter before using it in SQL statements when duplicating… Affected: before 4.1.4 |
| CVE-2024-39641 | 8.8 | Aug 26 | Cross-Site Request Forgery (CSRF) vulnerability in ThimPress LearnPress.This issue affects LearnPress: from n/a through 4.2.6.8.2 Affected: before 4.2.6.9 |
| CVE-2024-6589 | 8.8 | Jul 25 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.2.6.8.2 via the… Affected: through 4.2.6.8.2 |
| CVE-2023-36516 | 8.8 | Jun 19 | Missing Authorization vulnerability in ThimPress LearnPress.This issue affects LearnPress: from n/a through 4.2.3 Affected: before 4.2.3.1 |
| CVE-2024-4397 | 8.8 | May 14 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_post_materials' function in… Affected: before 4.2.6.6 |
| CVE-2024-2115 | 8.8 | Apr 5 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.0.0 Affected: before 4.0.1 |
| CVE-2022-45820 | 8.8 | Jan 26 | SQL Injection (SQLi) vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions Affected: through 4.1.7.3.2 |
| CVE-2020-6010 | 8.8 | Apr 30 | LearnPress Wordpress plugin version prior and including 3.2.6.7 is vulnerable to SQL Injection Affected: through 3.2.6.7 |
| CVE-2022-3360 | 8.1 | Oct 31 | LearnPress < 4.1.7.2 - Unauthenticated PHP Object Injection via REST API Affected: before 4.1.7.2 |
| CVE-2020-11511 | 8.1 | Jul 30 | The LearnPress plugin before 3.2.6.9 for WordPress allows remote attackers to escalate the privileges of any user to LP Instructor via the accept-to-be-teacher action parameter Affected: before 3.2.6.9 |
| CVE-2025-66054 | 7.5 | Dec 18 | WordPress LearnPress plugin <= 4.2.9.4 - Broken Access Control vulnerability Affected: through 4.2.9.4 |
| CVE-2024-8529 | 7.5 | Sep 12 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_fields' parameter of the /wp-json/lp/v1/courses/archive-course REST API… Affected: before 4.2.7.1 |
| CVE-2024-8522 | 7.5 | Sep 12 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_only_fields' parameter of the /wp-json/learnpress/v1/courses REST API endpoint… Affected: before 4.2.7.1 |
| CVE-2023-6567 | 7.5 | Jan 11 | The LearnPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order_by’ parameter in all versions up to, and including, 4.2.5.7 due to insufficient… Affected: before 4.2.5.8 |
| CVE-2018-16175 | 7.2 | Jan 9 | SQL injection vulnerability in the LearnPress prior to version 3.1.0 allows attacker with administrator rights to execute arbitrary SQL commands via unspecified vectors Affected: before 3.1.0 |
| CVE-2026-104670 | 7.1 | Oct 6 | WordPress LearnPress plugin <= 4.4.9 - Cross Site Scripting (XSS) vulnerability Affected: through 4.4.9 |
| CVE-2026-48865 | 7.1 | Jun 1 | WordPress LearnPress plugin <= 4.3.6 - Reflected Cross Site Scripting (XSS) vulnerability Affected: through 4.3.6 |
| CVE-2025-67536 | 6.5 | Dec 9 | WordPress LearnPress plugin <= 4.2.9.4 - Cross Site Scripting (XSS) vulnerability Affected: through 4.2.9.4 |
| CVE-2024-7548 | 6.5 | Aug 8 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'order' parameter in all versions up to, and including, 4.2.6.9.3 due… Affected: before 4.2.6.9.4 |
| CVE-2024-4444 | 6.5 | May 14 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to bypass to user registration in versions up to, and including, 4.2.6.5 Affected: before 4.2.6.6 |
| CVE-2020-7916 | 6.5 | Mar 16 | be_teacher in class-lp-admin-ajax.php in the LearnPress plugin 3.2.6.5 and earlier for WordPress allows any registered user to assign itself the teacher role via the… Affected: through 3.2.6.5 |
| CVE-2023-5558 | 6.1 | Jan 16 | The LearnPress WordPress plugin before 4.2.5.5 does not sanitise and escape user input before outputting it back in the page, leading to a Reflected Cross-Site Scripting which… Affected: before 4.2.5.5 |
| CVE-2023-30487 | 6.1 | May 18 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ThimPress LearnPress Export Import plugin <= 4.0.2 versions Affected: through 4.0.2 |
| CVE-2022-0271 | 6.1 | Apr 11 | The LearnPress WordPress plugin before 4.1.6 does not sanitise and escape the lp-dismiss-notice before outputting it back via the lp_background_single_email AJAX action, leading… Affected: before 4.1.6 |
| CVE-2018-16174 | 6.1 | Jan 9 | Open redirect vulnerability in LearnPress prior to version 3.1.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified… Affected: before 3.1.0 |
| CVE-2018-16173 | 6.1 | Jan 9 | Cross-site scripting vulnerability in LearnPress prior to version 3.1.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors Affected: before 3.1.0 |
| CVE-2026-115597 New | 5.4 | Oct 26 | WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability Affected: through 4.4.11 |
| CVE-2026-113353 | 5.4 | Oct 20 | LearnPress before 4.4.10 Missing Authorization via Legacy Editor AJAX Handlers Affected: before 4.4.10 |
| CVE-2026-110363 | 5.4 | Oct 19 | WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability Affected: through 4.4.10 |
| CVE-2026-105397 | 5.4 | Oct 5 | LearnPress WordPress Plugin through 4.4.9.1 Stored XSS via Quiz Question Hint and Explanation Affected: through 4.4.9.1 |
| CVE-2026-82024 | 5.4 | Sep 3 | LearnPress WordPress Plugin < 4.4.6 Stored XSS via Quiz Question Answer Titles Affected: before 4.4.6 |
| CVE-2024-13599 | 5.4 | Jan 25 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.2.7.5 due to insufficient input… Affected: before 4.2.7.5.1 |
| CVE-2024-4971 | 5.4 | May 22 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 4.2.6.6 due… Affected: before 4.2.6.7 |
| CVE-2024-4277 | 5.4 | May 14 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘layout_html’ parameter in all versions up to, and including,… Affected: before 4.2.6.6 |
| CVE-2024-3560 | 5.4 | Apr 19 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the _id value in all versions up to, and including, 4.2.6.4 due to… Affected: before 4.2.6.5 |
| CVE-2024-1289 | 5.4 | Apr 9 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.6.3 due to missing… Affected: before 4.2.6.4 |
| CVE-2026-115598 New | 5.3 | Oct 26 | WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability Affected: through 4.4.11 |
| CVE-2026-104403 | 5.3 | Oct 2 | WordPress LearnPress plugin <= 4.4.9 - Insecure Direct Object References (IDOR) vulnerability Affected: through 4.4.9 |
| CVE-2024-11868 | 5.3 | Dec 10 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.7.3 via… Affected: before 4.2.7.4 |
| CVE-2024-6099 | 5.3 | Jul 2 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthenticated bypass to user registration in versions up to, and including, 4.2.6.8.1 Affected: before 4.2.6.8.2 |
| CVE-2024-6088 | 5.3 | Jul 2 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized user registration due to a missing capability check on the 'register' function in all… Affected: before 4.2.6.8.2 |
| CVE-2024-5483 | 5.3 | Jun 5 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.6.8 due to incorrect… Affected: before 4.2.6.8.1 |
| CVE-2024-13128 | 4.8 | May 15 | The LearnPress WordPress plugin before 4.2.7.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored… Affected: before 4.2.7.5.1 |
| CVE-2024-13127 | 4.8 | May 15 | The LearnPress WordPress plugin before 4.2.7.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored… Affected: before 4.2.7.5.1 |
| CVE-2024-9881 | 4.8 | Dec 12 | The LearnPress WordPress plugin before 4.2.7.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored… Affected: before 4.2.7.2 |