LearnPress – WordPress LMS Plugin for Create and Sell Online Courses

67 known CVEs 70K+ active installs

Scan My Site Free
UNKNOWN: 67
Known Vulnerabilities 67
CVE-2026-113353 UNKNOWN EPSS 0.2%
Published 2026-10-20 · Affected: <4.4.10 · Fixed in 4.4.10
LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor and admin_question_editor lp-ajax actions, allowing instructors to modify other in
CVE-2026-113353 UNKNOWN EPSS 0.2%
Published 2026-10-20 · Affected: <4.4.10 · Fixed in 4.4.10
LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor and admin_question_editor lp-ajax actions, allowing instructors to modify other in
CVE-2026-113353 UNKNOWN EPSS 0.2%
Published 2026-10-20 · Affected: <4.4.10 · Fixed in 4.4.10
LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor and admin_question_editor lp-ajax actions, allowing instructors to modify other in
CVE-2026-113353 UNKNOWN EPSS 0.2%
Published 2026-10-20 · Affected: <4.4.10 · Fixed in 4.4.10
LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor and admin_question_editor lp-ajax actions, allowing instructors to modify other in
CVE-2026-107744 UNKNOWN EPSS 0.2%
Published 2026-10-17 · Affected: ≤4.4.10 · Fixed in 4.4.10
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.10 This is due to the plug
CVE-2026-107744 UNKNOWN EPSS 0.2%
Published 2026-10-17 · Affected: ≤4.4.10 · Fixed in 4.4.10
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.10 This is due to the plug
CVE-2026-104736 UNKNOWN EPSS 0.8%
Published 2026-10-17 · Affected: ≤4.4.10 · Fixed in 4.4.10
The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout-email' request parameter du
CVE-2026-104736 UNKNOWN EPSS 0.8%
Published 2026-10-17 · Affected: ≤4.4.10 · Fixed in 4.4.10
The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout-email' request parameter du
CVE-2026-109208 UNKNOWN EPSS 0.2%
Published 2026-10-17 · Affected: ≤4.4.10 · Fixed in 4.4.10
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'quantity (REST) / order_comments (checkout)' paramet
CVE-2026-109208 UNKNOWN EPSS 0.2%
Published 2026-10-17 · Affected: ≤4.4.10 · Fixed in 4.4.10
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'quantity (REST) / order_comments (checkout)' paramet
CVE-2026-105397 UNKNOWN EPSS 0.1%
Published 2026-10-05 · Affected: See advisory
LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fiel
CVE-2026-105397 UNKNOWN EPSS 0.1%
Published 2026-10-05 · Affected: See advisory
LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fiel
CVE-2026-105397 UNKNOWN EPSS 0.1%
Published 2026-10-05 · Affected: See advisory
LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fiel
CVE-2026-105397 UNKNOWN EPSS 0.1%
Published 2026-10-05 · Affected: See advisory
LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fiel
CVE-2026-105397 UNKNOWN EPSS 0.1%
Published 2026-10-05 · Affected: See advisory
LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fiel
CVE-2026-105397 UNKNOWN EPSS 0.1%
Published 2026-10-05 · Affected: See advisory
LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fiel
CVE-2026-105397 UNKNOWN EPSS 0.1%
Published 2026-10-05 · Affected: See advisory
LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fiel
CVE-2026-105397 UNKNOWN EPSS 0.1%
Published 2026-10-05 · Affected: See advisory
LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fiel
CVE-2026-92538 UNKNOWN EPSS 0.1%
Published 2026-10-03 · Affected: ≤4.4.7 · Fixed in 4.4.7
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'orderby' parameter in all versions up t
CVE-2026-93882 UNKNOWN EPSS 0.3%
Published 2026-10-01 · Affected: ≤4.4.8 · Fixed in 4.4.8
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.4.8 via the CourseMa
CVE-2026-93882 UNKNOWN EPSS 0.3%
Published 2026-10-01 · Affected: ≤4.4.8 · Fixed in 4.4.8
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.4.8 via the CourseMa
CVE-2026-12230 UNKNOWN EPSS 0.3%
Published 2026-09-08 · Affected: ≤4.3.9 · Fixed in 4.3.9
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'layout_custom_css' parameter in all versions up to,
CVE-2026-75982 UNKNOWN EPSS 0.3%
Published 2026-08-25 · Affected: ≤4.4.4 · Fixed in 4.4.4
The LearnPress plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in versions up to, and including, 4.4.4 via the learnpress_create_page AJAX action. The LP
CVE-2026-75982 UNKNOWN EPSS 0.3%
Published 2026-08-25 · Affected: ≤4.4.4 · Fixed in 4.4.4
The LearnPress plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in versions up to, and including, 4.4.4 via the learnpress_create_page AJAX action. The LP
CVE-2026-8502 UNKNOWN EPSS 0.4%
Published 2026-06-06 · Affected: See advisory
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.6 via the 'retur
CVE-2025-14802 UNKNOWN EPSS 0.3%
Published 2026-01-07 · Affected: ≤4.3.2 · Fixed in 4.3.2
The LearnPress – WordPress LMS Plugin for WordPress is vulnerable to unauthorized file deletion in versions up to, and including, 4.3.2.2 via the /wp-json/lp/v1/material/{file_id} REST API endpoint. T
CVE-2025-13956 UNKNOWN EPSS 0.6%
Published 2025-12-16 · Affected: ≤4.3.1 · Fixed in 4.3.1
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the statistic function in all versions up to, and including
CVE-2025-14387 UNKNOWN EPSS 0.1%
Published 2025-12-15 · Affected: ≤4.3.1 · Fixed in 4.3.1
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.3.1 due to insufficient input sanitization and output es
CVE-2025-11368 UNKNOWN EPSS 0.6%
Published 2025-11-21 · Affected: ≤4.2.9 · Fixed in 4.2.9
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 4.2.9.4. This is due to missing capability checks in
CVE-2025-11372 UNKNOWN EPSS 0.4%
Published 2025-10-18 · Affected: ≤4.2.9 · Fixed in 4.2.9
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to modification of data in all versions up to, and including, 4.2.9.2. This is due to missing capability checks on the Admin To
CVE-2025-11372 UNKNOWN EPSS 0.4%
Published 2025-10-18 · Affected: ≤4.2.9 · Fixed in 4.2.9
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to modification of data in all versions up to, and including, 4.2.9.2. This is due to missing capability checks on the Admin To
CVE-2024-11868 UNKNOWN EPSS 0.7%
Published 2024-12-10 · Affected: See advisory
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.7.3 via class-lp-rest-material-controller.php. This
CVE-2024-11868 UNKNOWN EPSS 0.7%
Published 2024-12-10 · Affected: See advisory
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.7.3 via class-lp-rest-material-controller.php. This
CVE-2024-8529 UNKNOWN EPSS 1.0%
Published 2024-09-12 · Affected: See advisory
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_fields' parameter of the /wp-json/lp/v1/courses/archive-course REST API endpoint in all versions up
CVE-2024-8529 UNKNOWN EPSS 1.0%
Published 2024-09-12 · Affected: See advisory
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_fields' parameter of the /wp-json/lp/v1/courses/archive-course REST API endpoint in all versions up
CVE-2024-8522 UNKNOWN EPSS 1.0%
Published 2024-09-12 · Affected: See advisory
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_only_fields' parameter of the /wp-json/learnpress/v1/courses REST API endpoint in all versions up t
CVE-2024-8522 UNKNOWN EPSS 1.0%
Published 2024-09-12 · Affected: See advisory
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_only_fields' parameter of the /wp-json/learnpress/v1/courses REST API endpoint in all versions up t
CVE-2024-6099 UNKNOWN EPSS 0.4%
Published 2024-07-02 · Affected: See advisory
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthenticated bypass to user registration in versions up to, and including, 4.2.6.8.1. This is due to missing checks in th
CVE-2024-6099 UNKNOWN EPSS 0.4%
Published 2024-07-02 · Affected: See advisory
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthenticated bypass to user registration in versions up to, and including, 4.2.6.8.1. This is due to missing checks in th
CVE-2024-6088 UNKNOWN EPSS 0.5%
Published 2024-07-02 · Affected: See advisory
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized user registration due to a missing capability check on the 'register' function in all versions up to, and inclu
CVE-2024-6088 UNKNOWN EPSS 0.5%
Published 2024-07-02 · Affected: See advisory
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized user registration due to a missing capability check on the 'register' function in all versions up to, and inclu
CVE-2024-5483 UNKNOWN EPSS 0.6%
Published 2024-06-05 · Affected: See advisory
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.6.8 due to incorrect implementation of get_items_pe
CVE-2024-5483 UNKNOWN EPSS 0.6%
Published 2024-06-05 · Affected: See advisory
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.6.8 due to incorrect implementation of get_items_pe
CVE-2024-4971 UNKNOWN EPSS 0.2%
Published 2024-05-22 · Affected: See advisory
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 4.2.6.6 due to insufficient inpu
CVE-2024-4971 UNKNOWN EPSS 0.2%
Published 2024-05-22 · Affected: See advisory
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 4.2.6.6 due to insufficient inpu
CVE-2024-4444 UNKNOWN EPSS 0.5%
Published 2024-05-14 · Affected: See advisory
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to bypass to user registration in versions up to, and including, 4.2.6.5. This is due to missing checks in the 'create_account'
CVE-2024-4444 UNKNOWN EPSS 0.5%
Published 2024-05-14 · Affected: See advisory
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to bypass to user registration in versions up to, and including, 4.2.6.5. This is due to missing checks in the 'create_account'
CVE-2024-4434 UNKNOWN EPSS 1.0%
Published 2024-05-14 · Affected: See advisory
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the ‘term_id’ parameter in versions up to, and including, 4.2.6.5 due to insufficient escaping
CVE-2024-4434 UNKNOWN EPSS 1.0%
Published 2024-05-14 · Affected: See advisory
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the ‘term_id’ parameter in versions up to, and including, 4.2.6.5 due to insufficient escaping
CVE-2024-4397 UNKNOWN EPSS 0.6%
Published 2024-05-14 · Affected: See advisory
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_post_materials' function in versions up to, and incl
CVE-2024-4397 UNKNOWN EPSS 0.6%
Published 2024-05-14 · Affected: See advisory
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_post_materials' function in versions up to, and incl
CVE-2024-4277 UNKNOWN EPSS 0.3%
Published 2024-05-14 · Affected: See advisory
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘layout_html’ parameter in all versions up to, and including, 4.2.6.5 due to insufficien
CVE-2024-4277 UNKNOWN EPSS 0.3%
Published 2024-05-14 · Affected: See advisory
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘layout_html’ parameter in all versions up to, and including, 4.2.6.5 due to insufficien
CVE-2024-3560 UNKNOWN EPSS 0.3%
Published 2024-04-19 · Affected: See advisory
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the _id value in all versions up to, and including, 4.2.6.4 due to insufficient input saniti
CVE-2024-3560 UNKNOWN EPSS 0.3%
Published 2024-04-19 · Affected: See advisory
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the _id value in all versions up to, and including, 4.2.6.4 due to insufficient input saniti
CVE-2024-1463 UNKNOWN EPSS 0.4%
Published 2024-04-09 · Affected: See advisory
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Course, Lesson, and Quiz title and content in all versions up to, and including, 4.2.6.3
CVE-2024-1463 UNKNOWN EPSS 0.4%
Published 2024-04-09 · Affected: See advisory
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Course, Lesson, and Quiz title and content in all versions up to, and including, 4.2.6.3
CVE-2024-1289 UNKNOWN EPSS 0.3%
Published 2024-04-09 · Affected: See advisory
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.6.3 due to missing validation on a user controlle
CVE-2024-1289 UNKNOWN EPSS 0.3%
Published 2024-04-09 · Affected: See advisory
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.6.3 due to missing validation on a user controlle
CVE-2024-2115 UNKNOWN EPSS 0.2%
Published 2024-04-05 · Affected: See advisory
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.0.0. This is due to missing or incorrect nonce validation
CVE-2024-2115 UNKNOWN EPSS 0.2%
Published 2024-04-05 · Affected: See advisory
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.0.0. This is due to missing or incorrect nonce validation
CVE-2023-6634 UNKNOWN EPSS 1.0%
Published 2024-01-11 · Affected: See advisory
The LearnPress plugin for WordPress is vulnerable to Command Injection in all versions up to, and including, 4.2.5.7 via the get_content function. This is due to the plugin making use of the call_user
CVE-2023-6634 UNKNOWN EPSS 1.0%
Published 2024-01-11 · Affected: See advisory
The LearnPress plugin for WordPress is vulnerable to Command Injection in all versions up to, and including, 4.2.5.7 via the get_content function. This is due to the plugin making use of the call_user
CVE-2023-6567 UNKNOWN EPSS 1.0%
Published 2024-01-11 · Affected: See advisory
The LearnPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order_by’ parameter in all versions up to, and including, 4.2.5.7 due to insufficient escaping on the user suppli
CVE-2023-6567 UNKNOWN EPSS 1.0%
Published 2024-01-11 · Affected: See advisory
The LearnPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order_by’ parameter in all versions up to, and including, 4.2.5.7 due to insufficient escaping on the user suppli
CVE-2023-6223 UNKNOWN EPSS 0.3%
Published 2024-01-11 · Affected: See advisory
The LearnPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.5.7 via the /wp-json/lp/v1/profile/course-tab REST API due to missing va
CVE-2023-6223 UNKNOWN EPSS 0.3%
Published 2024-01-11 · Affected: See advisory
The LearnPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.5.7 via the /wp-json/lp/v1/profile/course-tab REST API due to missing va

Is LearnPress &#8211; WordPress LMS Plugin for Create and Sell Online Courses running on your site?

A free scan detects your plugins and flags any that match these CVEs.

Scan My Site Free