LW
Product
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
45
CVEs
0
On KEV
9.8
Max CVSS
5
New 30D
Severity mix
Critical 4High 9Medium 32Low 0
Watch
Add LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-6589 | 8.8 | Jul 25 | LearnPress <= 4.2.6.8.2 - Authenticated (Contributor+) Local File Inclusion Affected: through 4.2.6.8.2 |
| CVE-2024-4397 | 8.8 | May 9 | LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Authenticated (Instructor+) Arbitrary File Upload Affected: through 4.2.6.5 |
| CVE-2024-2115 | 8.8 | Apr 5 | LearnPress – WordPress LMS Plugin <= 4.0.0 - Cross-Site Request Forgery to Privilege Escalation Affected: through 4.0.0 |
| CVE-2026-93882 | 7.5 | Oct 1 | LearnPress <= 4.4.8 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'item_id' Parameter Affected: through 4.4.8 |
| CVE-2026-13765 | 7.5 | Jul 17 | LearnPress <= 4.4.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure via /lp/v1/users/check-answer and /start-quiz REST Endpoints Affected: through 4.4.1 |
| CVE-2024-8522 | 7.5 | Sep 12 | LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_only_fields' Affected: through 4.2.7 |
| CVE-2024-8529 | 7.5 | Sep 12 | LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_fields' Affected: through 4.2.7 |
| CVE-2023-6567 | 7.5 | Jan 11 | LearnPress <= 4.2.5.7 - Unauthenticated SQL Injection via order_by Affected: through 4.2.5.7 |
| CVE-2026-109208 | 7.2 | Oct 17 | LearnPress <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' Parameters Affected: through 4.4.10 |
Showing 9