LE
Product
LearnPress
62
CVEs
0
On KEV
9.8
Max CVSS
9
New 30D
Severity mix
Critical 6High 17Medium 39Low 0
Watch
Add LearnPress to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-36515 | 9.8 | Jun 19 | WordPress LearnPress plugin <= 4.2.3 - Unauthenticated Broken Access Control vulnerability Affected: through 4.2.3 |
| CVE-2024-4434 | 9.8 | May 10 | LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Time-Based SQL Injection Affected: before 4.2.6.6 |
| CVE-2023-6634 | 9.8 | Jan 11 | The LearnPress plugin for WordPress is vulnerable to Command Injection in all versions up to, and including, 4.2.5.7 via the get_content function Affected: through 4.2.5.7 |
| CVE-2022-47615 | 9.8 | Jan 26 | Local File Inclusion vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions Affected: before 4.2.0 |
| CVE-2022-45808 | 9.8 | Jan 26 | SQL Injection vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions Affected: through 4.1.7.3.2 |
| CVE-2021-24951 | 9.8 | Dec 13 | The LearnPress WordPress plugin before 4.1.4 does not sanitise, validate and escape the id parameter before using it in SQL statements when duplicating… Affected: before 4.1.4 |
| CVE-2024-39641 | 8.8 | Aug 26 | WordPress LearnPress plugin <= 4.2.6.8.2 - Cross Site Request Forgery (CSRF) vulnerability Affected: through 4.2.6.8.2 |
| CVE-2024-6589 | 8.8 | Jul 25 | LearnPress <= 4.2.6.8.2 - Authenticated (Contributor+) Local File Inclusion Affected: through 4.2.6.8.2 |
| CVE-2023-36516 | 8.8 | Jun 19 | WordPress LearnPress plugin <= 4.2.3 - Authenticated Broken Access Control vulnerability Affected: through 4.2.3 |
| CVE-2024-4397 | 8.8 | May 9 | LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Authenticated (Instructor+) Arbitrary File Upload Affected: before 4.2.6.6 |
| CVE-2024-2115 | 8.8 | Apr 5 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.0.0 Affected: before 4.0.1 |
| CVE-2022-45820 | 8.8 | Jan 26 | SQL Injection (SQLi) vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions Affected: through 4.1.7.3.2 |
| CVE-2020-6010 | 8.8 | Apr 30 | LearnPress Wordpress plugin version prior and including 3.2.6.7 is vulnerable to SQL Injection Affected: through 3.2.6.7 |
| CVE-2022-3360 | 8.1 | Oct 31 | LearnPress < 4.1.7.2 - Unauthenticated PHP Object Injection via REST API Affected: before 4.1.7.2 |
| CVE-2020-11511 | 8.1 | Jul 30 | The LearnPress plugin before 3.2.6.9 for WordPress allows remote attackers to escalate the privileges of any user to LP Instructor via the accept-to-be-teacher action parameter Affected: before 3.2.6.9 |
| CVE-2026-115599 New | 7.5 | Oct 29 | WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability Affected: through 4.4.11 |
| CVE-2025-66054 | 7.5 | Dec 18 | WordPress LearnPress plugin <= 4.2.9.4 - Broken Access Control vulnerability Affected: through 4.2.9.4 |
| CVE-2024-8522 | 7.5 | Sep 12 | LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_only_fields' Affected: before 4.2.7.1 |
| CVE-2024-8529 | 7.5 | Sep 12 | LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_fields' Affected: before 4.2.7.1 |
| CVE-2023-6567 | 7.5 | Jan 11 | The LearnPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order_by’ parameter in all versions up to, and including, 4.2.5.7 due to insufficient… Affected: before 4.2.5.8 |
| CVE-2018-16175 | 7.2 | Jan 9 | SQL injection vulnerability in the LearnPress prior to version 3.1.0 allows attacker with administrator rights to execute arbitrary SQL commands via unspecified vectors Affected: before 3.1.0 |
| CVE-2026-104670 | 7.1 | Oct 6 | WordPress LearnPress plugin <= 4.4.9 - Cross Site Scripting (XSS) vulnerability Affected: through 4.4.9 |
| CVE-2026-48865 | 7.1 | Jun 1 | WordPress LearnPress plugin <= 4.3.6 - Reflected Cross Site Scripting (XSS) vulnerability Affected: through 4.3.6 |
| CVE-2025-67536 | 6.5 | Dec 9 | WordPress LearnPress plugin <= 4.2.9.4 - Cross Site Scripting (XSS) vulnerability Affected: through 4.2.9.4 |
| CVE-2024-39642 | 6.5 | Aug 13 | WordPress LearnPress plugin <= 4.2.6.8.2 - Insecure Direct Object References (IDOR) vulnerability Affected: through 4.2.6.8.2 |
| CVE-2024-7548 | 6.5 | Aug 8 | LearnPress – WordPress LMS Plugin <= 4.2.6.9.3 - Authenticated (Contributor+) SQL Injection via order Parameter Affected: before 4.2.6.9.4 |
| CVE-2024-4444 | 6.5 | May 10 | LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Bypass to User Registration Affected: before 4.2.6.6 |
| CVE-2020-7916 | 6.5 | Mar 16 | be_teacher in class-lp-admin-ajax.php in the LearnPress plugin 3.2.6.5 and earlier for WordPress allows any registered user to assign itself the teacher role via the… Affected: through 3.2.6.5 |
| CVE-2023-5558 | 6.1 | Jan 16 | The LearnPress WordPress plugin before 4.2.5.5 does not sanitise and escape user input before outputting it back in the page, leading to a Reflected Cross-Site Scripting which… Affected: before 4.2.5.5 |
| CVE-2023-30487 | 6.1 | May 18 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ThimPress LearnPress Export Import plugin <= 4.0.2 versions Affected: through 4.0.2 |
| CVE-2022-0271 | 6.1 | Apr 11 | The LearnPress WordPress plugin before 4.1.6 does not sanitise and escape the lp-dismiss-notice before outputting it back via the lp_background_single_email AJAX action, leading… Affected: before 4.1.6 |
| CVE-2018-16174 | 6.1 | Jan 9 | Open redirect vulnerability in LearnPress prior to version 3.1.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified… Affected: before 3.1.0 |
| CVE-2018-16173 | 6.1 | Jan 9 | Cross-site scripting vulnerability in LearnPress prior to version 3.1.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors Affected: before 3.1.0 |
| CVE-2026-115597 New | 5.4 | Oct 26 | WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability Affected: through 4.4.11 |
| CVE-2026-113353 | 5.4 | Oct 20 | LearnPress before 4.4.10 Missing Authorization via Legacy Editor AJAX Handlers Affected: before 4.4.10 |
| CVE-2026-110363 | 5.4 | Oct 19 | WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability Affected: through 4.4.10 |
| CVE-2026-105397 | 5.4 | Oct 5 | LearnPress WordPress Plugin through 4.4.9.1 Stored XSS via Quiz Question Hint and Explanation Affected: through 4.4.9.1 |
| CVE-2026-82024 | 5.4 | Sep 3 | LearnPress WordPress Plugin < 4.4.6 Stored XSS via Quiz Question Answer Titles Affected: before 4.4.6 |
| CVE-2024-13599 | 5.4 | Jan 25 | LearnPress – WordPress LMS Plugin <= 4.2.7.5 - Authenticated (LP Instructor+) Stored Cross-Site Scripting via Lesson Name Affected: before 4.2.7.5.1 |
| CVE-2024-4971 | 5.4 | May 22 | LearnPress – WordPress LMS Plugin <= 4.2.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter Affected: before 4.2.6.7 |
| CVE-2024-4277 | 5.4 | May 10 | LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via layout_html Parameter Affected: before 4.2.6.6 |
| CVE-2024-3560 | 5.4 | Apr 19 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the _id value in all versions up to, and including, 4.2.6.4 due to… Affected: before 4.2.6.5 |
| CVE-2024-1289 | 5.4 | Apr 9 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.6.3 due to missing… Affected: before 4.2.6.4 |
| CVE-2026-115598 New | 5.3 | Oct 26 | WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability Affected: through 4.4.11 |
| CVE-2026-104403 | 5.3 | Oct 2 | WordPress LearnPress plugin <= 4.4.9 - Insecure Direct Object References (IDOR) vulnerability Affected: through 4.4.9 |
| CVE-2025-22739 | 5.3 | Mar 27 | WordPress LearnPress plugin <= 4.2.7.5 - Broken Access Control vulnerability Affected: through 4.2.7.5 |
| CVE-2024-11868 | 5.3 | Dec 10 | LearnPress – WordPress LMS Plugin <= 4.2.7.3 - Course Material Sensitive Information Exposure via REST API Affected: before 4.2.7.4 |
| CVE-2024-6099 | 5.3 | Jul 2 | LearnPress – WordPress LMS Plugin <= 4.2.6.8.1 - Unauthenticated Bypass to User Registration Affected: before 4.2.6.8.2 |
| CVE-2024-6088 | 5.3 | Jul 2 | LearnPress – WordPress LMS Plugin <= 4.2.6.8.1 - Missing Authorization to Unauthenticated User Registration Bypass Affected: before 4.2.6.8.2 |
| CVE-2024-5483 | 5.3 | Jun 5 | LearnPress – WordPress LMS Plugin <= 4.2.6.8 - Basic Information Disclosure via JSON API Affected: before 4.2.6.8.1 |