LE
Product
LearnPress
62
CVEs
0
On KEV
9.8
Max CVSS
9
New 30D
Severity mix
Critical 6High 17Medium 39Low 0
Watch
Add LearnPress to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-67536 | 6.5 | Dec 9 | WordPress LearnPress plugin <= 4.2.9.4 - Cross Site Scripting (XSS) vulnerability Affected: through 4.2.9.4 |
| CVE-2024-39642 | 6.5 | Aug 13 | WordPress LearnPress plugin <= 4.2.6.8.2 - Insecure Direct Object References (IDOR) vulnerability Affected: through 4.2.6.8.2 |
| CVE-2024-7548 | 6.5 | Aug 8 | LearnPress – WordPress LMS Plugin <= 4.2.6.9.3 - Authenticated (Contributor+) SQL Injection via order Parameter Affected: before 4.2.6.9.4 |
| CVE-2024-4444 | 6.5 | May 10 | LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Bypass to User Registration Affected: before 4.2.6.6 |
| CVE-2020-7916 | 6.5 | Mar 16 | be_teacher in class-lp-admin-ajax.php in the LearnPress plugin 3.2.6.5 and earlier for WordPress allows any registered user to assign itself the teacher role via the… Affected: through 3.2.6.5 |
| CVE-2023-5558 | 6.1 | Jan 16 | The LearnPress WordPress plugin before 4.2.5.5 does not sanitise and escape user input before outputting it back in the page, leading to a Reflected Cross-Site Scripting which… Affected: before 4.2.5.5 |
| CVE-2023-30487 | 6.1 | May 18 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ThimPress LearnPress Export Import plugin <= 4.0.2 versions Affected: through 4.0.2 |
| CVE-2022-0271 | 6.1 | Apr 11 | The LearnPress WordPress plugin before 4.1.6 does not sanitise and escape the lp-dismiss-notice before outputting it back via the lp_background_single_email AJAX action, leading… Affected: before 4.1.6 |
| CVE-2018-16174 | 6.1 | Jan 9 | Open redirect vulnerability in LearnPress prior to version 3.1.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified… Affected: before 3.1.0 |
| CVE-2018-16173 | 6.1 | Jan 9 | Cross-site scripting vulnerability in LearnPress prior to version 3.1.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors Affected: before 3.1.0 |
| CVE-2026-115597 New | 5.4 | Oct 26 | WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability Affected: through 4.4.11 |
| CVE-2026-113353 | 5.4 | Oct 20 | LearnPress before 4.4.10 Missing Authorization via Legacy Editor AJAX Handlers Affected: before 4.4.10 |
| CVE-2026-110363 | 5.4 | Oct 19 | WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability Affected: through 4.4.10 |
| CVE-2026-105397 | 5.4 | Oct 5 | LearnPress WordPress Plugin through 4.4.9.1 Stored XSS via Quiz Question Hint and Explanation Affected: through 4.4.9.1 |
| CVE-2026-82024 | 5.4 | Sep 3 | LearnPress WordPress Plugin < 4.4.6 Stored XSS via Quiz Question Answer Titles Affected: before 4.4.6 |
| CVE-2024-13599 | 5.4 | Jan 25 | LearnPress – WordPress LMS Plugin <= 4.2.7.5 - Authenticated (LP Instructor+) Stored Cross-Site Scripting via Lesson Name Affected: before 4.2.7.5.1 |
| CVE-2024-4971 | 5.4 | May 22 | LearnPress – WordPress LMS Plugin <= 4.2.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter Affected: before 4.2.6.7 |
| CVE-2024-4277 | 5.4 | May 10 | LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via layout_html Parameter Affected: before 4.2.6.6 |
| CVE-2024-3560 | 5.4 | Apr 19 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the _id value in all versions up to, and including, 4.2.6.4 due to… Affected: before 4.2.6.5 |
| CVE-2024-1289 | 5.4 | Apr 9 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.6.3 due to missing… Affected: before 4.2.6.4 |
| CVE-2026-115598 New | 5.3 | Oct 26 | WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability Affected: through 4.4.11 |
| CVE-2026-104403 | 5.3 | Oct 2 | WordPress LearnPress plugin <= 4.4.9 - Insecure Direct Object References (IDOR) vulnerability Affected: through 4.4.9 |
| CVE-2025-22739 | 5.3 | Mar 27 | WordPress LearnPress plugin <= 4.2.7.5 - Broken Access Control vulnerability Affected: through 4.2.7.5 |
| CVE-2024-11868 | 5.3 | Dec 10 | LearnPress – WordPress LMS Plugin <= 4.2.7.3 - Course Material Sensitive Information Exposure via REST API Affected: before 4.2.7.4 |
| CVE-2024-6099 | 5.3 | Jul 2 | LearnPress – WordPress LMS Plugin <= 4.2.6.8.1 - Unauthenticated Bypass to User Registration Affected: before 4.2.6.8.2 |
| CVE-2024-6088 | 5.3 | Jul 2 | LearnPress – WordPress LMS Plugin <= 4.2.6.8.1 - Missing Authorization to Unauthenticated User Registration Bypass Affected: before 4.2.6.8.2 |
| CVE-2024-5483 | 5.3 | Jun 5 | LearnPress – WordPress LMS Plugin <= 4.2.6.8 - Basic Information Disclosure via JSON API Affected: before 4.2.6.8.1 |
| CVE-2024-13128 | 4.8 | May 15 | LearnPress – WordPress LMS Plugin < 4.2.7.5.1 - Admin+ Stored XSS Affected: before 4.2.7.5.1 |
| CVE-2024-13127 | 4.8 | May 15 | LearnPress – WordPress LMS Plugin < 4.2.7.5.1 - Admin+ Stored XSS Affected: before 4.2.7.5.1 |
| CVE-2024-9881 | 4.8 | Dec 12 | LearnPress < 4.2.7.2 - Admin+ Stored XSS Affected: before 4.2.7.2 |
| CVE-2024-10010 | 4.8 | Dec 12 | LearnPress < 4.2.7.2 - Admin+ Stored XSS Affected: before 4.2.7.2 |
| CVE-2024-1463 | 4.8 | Apr 9 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Course, Lesson, and Quiz title and content in all versions up to,… Affected: before 4.2.6.4 |
| CVE-2021-39348 | 4.8 | Oct 21 | The LearnPress WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping on the $custom_profile parameter found in the… Affected: through 4.1.3.1 |
| CVE-2021-24702 | 4.8 | Oct 18 | The LearnPress WordPress plugin before 4.1.3.1 does not properly sanitize or escape various inputs within course settings, which could allow high privilege users to perform… Affected: before 4.1.3.1 |
| CVE-2025-24740 | 4.7 | Jan 27 | WordPress Learnpress plugin <= 4.2.7.1 - Open Redirection vulnerability Affected: through 4.2.7.1 |
| CVE-2026-39717 | 4.3 | Oct 2 | WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability Affected: through 4.4.10 |
| CVE-2026-82023 | 4.3 | Sep 3 | LearnPress WordPress Plugin < 4.4.6 Broken Object-Level Authorization via Quiz Answer Insert Affected: before 4.4.6 |
| CVE-2023-6223 | 4.3 | Jan 11 | The LearnPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.5.7 via the /wp-json/lp/v1/profile/course-tab REST… Affected: through 4.2.5.7 |
| CVE-2022-0377 | 4.3 | Feb 28 | Users of the LearnPress WordPress plugin before 4.1.5 can upload an image as a profile avatar after the registration Affected: before 4.1.5 |
Showing 39