LW
Product
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
24
CVEs
0
On KEV
9.8
Max CVSS
5
New 30D
Severity mix
Critical 2High 3Medium 19Low 0
Watch
Add LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-104736 | 9.8 | Oct 17 | LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter Affected: through 4.4.10 |
| CVE-2026-4365 | 9.1 | Apr 14 | LearnPress <= 4.3.2.8 - Missing Authorization to Unauthenticated Arbitrary Quiz Answer Deletion Affected: through 4.3.2.8 |
| CVE-2026-93882 | 7.5 | Oct 1 | LearnPress <= 4.4.8 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'item_id' Parameter Affected: through 4.4.8 |
| CVE-2026-13765 | 7.5 | Jul 17 | LearnPress <= 4.4.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure via /lp/v1/users/check-answer and /start-quiz REST Endpoints Affected: through 4.4.1 |
| CVE-2026-109208 | 7.2 | Oct 17 | LearnPress <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' Parameters Affected: through 4.4.10 |
| CVE-2026-107744 | 6.5 | Oct 17 | LearnPress <= 4.4.10 - Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via 'search-authors' AJAX Action Affected: through 4.4.10 |
| CVE-2026-11988 | 6.5 | Jul 1 | LearnPress <= 4.3.9.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'userId' Parameter Affected: through 4.3.9.1 |
| CVE-2025-11372 | 6.5 | Oct 18 | LearnPress – WordPress LMS Plugin <= 4.2.9.3 - Missing Authorization to Unauthenticated Database Table Manipulation Affected: through 4.2.9.3 |
| CVE-2026-12230 | 6.4 | Sep 8 | LearnPress <= 4.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'layout_custom_css' Affected: through 4.3.9.1 |
| CVE-2026-12732 | 6.4 | Jul 1 | LearnPress <= 4.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class_wrapper_form' Shortcode Attribute Affected: through 4.4.0 |
| CVE-2026-4333 | 6.4 | Apr 8 | LearnPress <= 4.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'skin' Shortcode Attribute Affected: through 4.3.3 |
| CVE-2025-14387 | 6.4 | Dec 15 | LearnPress – WordPress LMS Plugin <= 4.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via get_profile_social Affected: through 4.3.1 |
| CVE-2026-92538 | 6.1 | Oct 3 | LearnPress <= 4.4.7 - Reflected DOM-Based Cross-Site Scripting via 'orderby' Parameter Affected: through 4.4.7 |
| CVE-2025-14802 | 5.4 | Jan 7 | LearnPress – WordPress LMS Plugin <= 4.3.2.2 - Insecure Direct Object Reference to Authenticated (Instructor+) Teacher Material Deletion Affected: through 4.3.2.1 |
| CVE-2026-8502 | 5.3 | Jun 6 | LearnPress <= 4.3.6 - Unauthenticated Sensitive Information Exposure via 'c_status' and 'return_type' Parameters Affected: through 4.3.6 |
| CVE-2025-14798 | 5.3 | Jan 20 | LearnPress – WordPress LMS Plugin <= 4.3.2.4 - Missing Authorization to Unauthenticated Sensitive User Information Disclosure via REST API Affected: through 4.3.2.4 |
| CVE-2025-13964 | 5.3 | Jan 6 | LearnPress – WordPress LMS Plugin <= 4.3.2 - Missing Authentication to Unauthenticated Course Modification Affected: through 4.3.2 |
| CVE-2025-13956 | 5.3 | Dec 16 | LearnPress – WordPress LMS Plugin <= 4.3.1 - Missing Authorization to Unauthenticated Orders Statistics Exposure Affected: through 4.3.1 |
| CVE-2025-11368 | 5.3 | Nov 21 | LearnPress – WordPress LMS Plugin <= 4.2.9.4 - Missing Authorization to Unauthenticated Arbitrary Callback Execution to Information Exposure Affected: through 4.2.9.4 |
| CVE-2026-77823 | 4.9 | Sep 1 | LearnPress <= 4.4.4 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter Affected: through 4.4.4 |
| CVE-2026-75982 | 4.4 | Aug 25 | LearnPress <= 4.4.4 - Missing Authorization to Authenticated (Editor+) Limited Option Update via 'field_name' Parameter Affected: through 4.4.4 |
| CVE-2026-7648 | 4.3 | May 14 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.5 - Authenticated (Subscriber+) Payment Bypass to Free Course Enrollment via 'quantity' Parameter Affected: through 4.3.5 |
| CVE-2026-3225 | 4.3 | Mar 23 | LearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Answer Deletion Affected: through 4.3.2.8 |
| CVE-2026-3226 | 4.3 | Mar 12 | LearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Notification Triggering Affected: through 4.3.2.8 |
Showing 24