LE
Product
LearnPress
58
CVEs
0
On KEV
9.8
Max CVSS
8
New 30D
Severity mix
Critical 6High 16Medium 36Low 0
Watch
Add LearnPress to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-39641 | 8.8 | Aug 26 | Cross-Site Request Forgery (CSRF) vulnerability in ThimPress LearnPress.This issue affects LearnPress: from n/a through 4.2.6.8.2 Affected: before 4.2.6.9 |
| CVE-2024-6589 | 8.8 | Jul 25 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.2.6.8.2 via the… Affected: through 4.2.6.8.2 |
| CVE-2023-36516 | 8.8 | Jun 19 | Missing Authorization vulnerability in ThimPress LearnPress.This issue affects LearnPress: from n/a through 4.2.3 Affected: before 4.2.3.1 |
| CVE-2024-4397 | 8.8 | May 14 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_post_materials' function in… Affected: before 4.2.6.6 |
| CVE-2024-2115 | 8.8 | Apr 5 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.0.0 Affected: before 4.0.1 |
| CVE-2022-45820 | 8.8 | Jan 26 | SQL Injection (SQLi) vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions Affected: through 4.1.7.3.2 |
| CVE-2020-6010 | 8.8 | Apr 30 | LearnPress Wordpress plugin version prior and including 3.2.6.7 is vulnerable to SQL Injection Affected: through 3.2.6.7 |
| CVE-2022-3360 | 8.1 | Oct 31 | LearnPress < 4.1.7.2 - Unauthenticated PHP Object Injection via REST API Affected: before 4.1.7.2 |
| CVE-2020-11511 | 8.1 | Jul 30 | The LearnPress plugin before 3.2.6.9 for WordPress allows remote attackers to escalate the privileges of any user to LP Instructor via the accept-to-be-teacher action parameter Affected: before 3.2.6.9 |
| CVE-2025-66054 | 7.5 | Dec 18 | WordPress LearnPress plugin <= 4.2.9.4 - Broken Access Control vulnerability Affected: through 4.2.9.4 |
| CVE-2024-8529 | 7.5 | Sep 12 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_fields' parameter of the /wp-json/lp/v1/courses/archive-course REST API… Affected: before 4.2.7.1 |
| CVE-2024-8522 | 7.5 | Sep 12 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_only_fields' parameter of the /wp-json/learnpress/v1/courses REST API endpoint… Affected: before 4.2.7.1 |
| CVE-2023-6567 | 7.5 | Jan 11 | The LearnPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order_by’ parameter in all versions up to, and including, 4.2.5.7 due to insufficient… Affected: before 4.2.5.8 |
| CVE-2018-16175 | 7.2 | Jan 9 | SQL injection vulnerability in the LearnPress prior to version 3.1.0 allows attacker with administrator rights to execute arbitrary SQL commands via unspecified vectors Affected: before 3.1.0 |
| CVE-2026-104670 | 7.1 | Oct 6 | WordPress LearnPress plugin <= 4.4.9 - Cross Site Scripting (XSS) vulnerability Affected: through 4.4.9 |
| CVE-2026-48865 | 7.1 | Jun 1 | WordPress LearnPress plugin <= 4.3.6 - Reflected Cross Site Scripting (XSS) vulnerability Affected: through 4.3.6 |
Showing 16