LE
Product
LearnPress
65
CVEs
0
On KEV
9.8
Max CVSS
10
New 30D
Severity mix
Critical 6High 19Medium 40Low 0
Watch
Add LearnPress to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-39641 | 8.8 | Aug 26 | WordPress LearnPress plugin <= 4.2.6.8.2 - Cross Site Request Forgery (CSRF) vulnerability Affected: through 4.2.6.8.2 |
| CVE-2024-6589 | 8.8 | Jul 25 | LearnPress <= 4.2.6.8.2 - Authenticated (Contributor+) Local File Inclusion Affected: through 4.2.6.8.2 |
| CVE-2023-36516 | 8.8 | Jun 19 | WordPress LearnPress plugin <= 4.2.3 - Authenticated Broken Access Control vulnerability Affected: through 4.2.3 |
| CVE-2024-4397 | 8.8 | May 9 | LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Authenticated (Instructor+) Arbitrary File Upload Affected: before 4.2.6.6 |
| CVE-2024-2115 | 8.8 | Apr 5 | LearnPress – WordPress LMS Plugin <= 4.0.0 - Cross-Site Request Forgery to Privilege Escalation Affected: before 4.0.1 |
| CVE-2022-45820 | 8.8 | Jan 26 | SQL Injection (SQLi) vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions Affected: through 4.1.7.3.2 |
| CVE-2020-6010 | 8.8 | Apr 30 | LearnPress Wordpress plugin version prior and including 3.2.6.7 is vulnerable to SQL Injection Affected: through 3.2.6.7 |
| CVE-2022-3360 | 8.1 | Oct 31 | LearnPress < 4.1.7.2 - Unauthenticated PHP Object Injection via REST API Affected: before 4.1.7.2 |
| CVE-2020-11511 | 8.1 | Jul 30 | The LearnPress plugin before 3.2.6.9 for WordPress allows remote attackers to escalate the privileges of any user to LP Instructor via the accept-to-be-teacher action parameter Affected: before 3.2.6.9 |
| CVE-2024-31241 | 7.6 | Apr 7 | WordPress LearnPress Export Import plugin <= 4.0.3 - Auth. SQL Injection vulnerability Affected: through 4.0.3 |
| CVE-2026-115599 New | 7.5 | Oct 29 | WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability Affected: through 4.4.11 |
| CVE-2025-66054 | 7.5 | Dec 18 | WordPress LearnPress plugin <= 4.2.9.4 - Broken Access Control vulnerability Affected: through 4.2.9.4 |
| CVE-2024-8522 | 7.5 | Sep 12 | LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_only_fields' Affected: before 4.2.7.1 |
| CVE-2024-8529 | 7.5 | Sep 12 | LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_fields' Affected: before 4.2.7.1 |
| CVE-2023-6567 | 7.5 | Jan 11 | LearnPress <= 4.2.5.7 - Unauthenticated SQL Injection via order_by Affected: before 4.2.5.8 |
| CVE-2018-16175 | 7.2 | Jan 9 | SQL injection vulnerability in the LearnPress prior to version 3.1.0 allows attacker with administrator rights to execute arbitrary SQL commands via unspecified vectors Affected: before 3.1.0 |
| CVE-2026-104670 | 7.1 | Oct 6 | WordPress LearnPress plugin <= 4.4.9 - Cross Site Scripting (XSS) vulnerability Affected: through 4.4.9 |
| CVE-2026-48865 | 7.1 | Jun 1 | WordPress LearnPress plugin <= 4.3.6 - Reflected Cross Site Scripting (XSS) vulnerability Affected: through 4.3.6 |
| CVE-2024-32588 | 7.1 | Apr 18 | WordPress LearnPress Export Import plugin <= 4.0.3 - Reflected Cross Site Scripting (XSS) vulnerability Affected: All versions, or not specified |
Showing 19