Is LearnPress safe?

Every recorded flaw

• Oct 26, 2026LearnPress: Missing AuthorizationCVE-2026-115598 · affects up to 4.4.11 · reported by PatchstackMedium 5.3
• Oct 26, 2026LearnPress: Missing AuthorizationCVE-2026-115597 · affects up to 4.4.11 · reported by PatchstackMedium 5.4
• Oct 20, 2026LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor and admin_question_editor lp-ajax actions,CVE-2026-113353 · fixed in 4.4.10 · reported by VulnCheckMedium 5.3
• Oct 19, 2026LearnPress: Missing AuthorizationCVE-2026-110363 · affects up to 4.4.10 · reported by PatchstackMedium 5.4
• Oct 17, 2026LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: Authorization bypassCVE-2026-107744 · affects up to 4.4.10 · reported by WordfenceMedium 6.5
• Oct 17, 2026LearnPress: PHP Object InjectionCVE-2026-104736 · affects up to 4.4.10 · reported by WordfenceCritical 9.8
• Oct 16, 2026LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: Stored Cross-Site ScriptingCVE-2026-109208 · affects up to 4.4.10 · reported by WordfenceHigh 7.2
• Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 versions.CVE-2026-104670 · affects up to 4.4.9 · reported by PatchstackHigh 7.1
• Oct 5, 2026LearnPress: Stored cross-site scriptingCVE-2026-105397 · affects up to 4.4.9.1 · reported by VulnCheckMedium 5.1
• Oct 3, 2026LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: Reflected DOM-Based Cross-Site ScriptingCVE-2026-92538 · affects up to 4.4.7 · reported by WordfenceMedium 6.1
• Oct 2, 2026LearnPress: Missing AuthorizationCVE-2026-39717 · affects up to 4.4.10 · reported by PatchstackMedium 4.3
• Oct 2, 2026LearnPress: Authorization Bypass Through User-Controlled KeyCVE-2026-104403 · affects up to 4.4.9 · reported by PatchstackMedium 5.3
• Oct 1, 2026LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: Insecure Direct Object ReferenceCVE-2026-93882 · affects up to 4.4.8 · reported by WordfenceHigh 7.5
• Sep 17, 2026LearnPress: Does not restrict the correctness flags it returnsCVE-2026-86446 · fixed in 4.4.7 · reported by WPScanLow 3.7
• Sep 16, 2026LearnPress: Does not check the user's capabilities before applying a user supplied post status filter in one of its REST routesCVE-2026-86449 · fixed in 4.4.7 · reported by WPScanMedium 5.3
• Sep 16, 2026LearnPress: Does not perform any authenticationCVE-2026-86448 · fixed in 4.4.7 · reported by WPScanLow 3.7
• Sep 16, 2026LearnPress: Does not check the user's capabilities in one of its administrative course toolsCVE-2026-86447 · fixed in 4.4.7 · reported by WPScanMedium 5.3
• Sep 16, 2026LearnPress: Does not check the user's capabilities in one of its administrative template handlersCVE-2026-86445 · fixed in 4.4.7 · reported by WPScanMedium 5.3
• Sep 16, 2026LearnPress: Does not escape a user supplied value before using it in an HTML attribute on a public pageCVE-2026-86444 · fixed in 4.4.7 · reported by WPScanHigh 7.1
• Sep 8, 2026LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: Stored Cross-Site ScriptingCVE-2026-12230 · affects up to 4.3.9.1 · reported by WordfenceMedium 6.4
• Sep 3, 2026LearnPress WordPress Plugin before 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers with the Instructor role to inCVE-2026-82024 · fixed in 4.4.6 · reported by VulnCheckMedium 5.1
• Sep 3, 2026LearnPress WordPress Plugin before 4.4.6 contains a broken object-level authorization vulnerability that allows authenticated attackers with the Instructor roleCVE-2026-82023 · fixed in 4.4.6 · reported by VulnCheckMedium 5.3
• Sep 1, 2026LearnPress: SQL InjectionCVE-2026-77823 · affects up to 4.4.4 · reported by WordfenceMedium 4.9
• Aug 27, 2026LearnPress: Does not perform any authorization check on one of its REST endpoints in all versions up toCVE-2026-78125 · affects up to 4.0.2 · fixed in 4.0.3 · reported by WPScanMedium 5.3
• Aug 24, 2026LearnPress: Unauthorized modification of arbitrary WordPress optionsCVE-2026-75982 · affects up to 4.4.4 · reported by WordfenceMedium 4.4
• Aug 12, 2026LearnPress: Does not verify that a user is enrolled in a course before processing AI-assistant requests against that course's lesson contentCVE-2026-12976 · fixed in 4.4.4 · reported by WPScanMedium 6.5
• Aug 10, 2026LearnPress: Does not validate a user-supplied URL before the server fetches itCVE-2026-12971 · fixed in 4.4.4 · reported by WPScanLow 2.2
• Jul 20, 2026LearnPress: Does not escape a search parameter before reflecting it into an HTML attributeCVE-2026-12970 · fixed in 4.4.1 · reported by WPScanHigh 7.1
• Jul 17, 2026LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: Sensitive Information ExposureCVE-2026-13765 · affects up to 4.4.1 · reported by WordfenceHigh 7.5
• Jul 1, 2026LearnPress: Stored Cross-Site ScriptingCVE-2026-12732 · affects up to 4.4.0 · reported by WordfenceMedium 6.4
• Jul 1, 2026LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: Insecure Direct Object ReferenceCVE-2026-11988 · affects up to 4.3.9.1 · reported by WordfenceMedium 6.5
• Jun 17, 2026LearnPress: Does not gate the `edit` context on one of its REST endpoint behind the `edit_users` capabilityCVE-2026-8383 · fixed in 4.3.7 · reported by WPScan7.6% oddsMedium 5.3
• Jun 6, 2026LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: Sensitive Information ExposureCVE-2026-8502 · affects up to 4.3.6 · reported by WordfenceMedium 5.3
• Jun 1, 2026LearnPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-48865 · affects up to 4.3.6 · reported by PatchstackHigh 7.1
• May 14, 2026LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: Payment bypass through user-controlled keyCVE-2026-7648 · affects up to 4.3.5 · reported by WordfenceMedium 4.3
• Apr 13, 2026LearnPress: Unauthorized data deletionCVE-2026-4365 · affects up to 4.3.2.8 · reported by WordfenceCritical 9.1
• Apr 8, 2026LearnPress – WordPress LMS: Stored Cross-Site ScriptingCVE-2026-4333 · affects up to 4.3.3 · reported by WordfenceMedium 6.4
• Mar 23, 2026LearnPress – WordPress LMS: Unauthorized deletion of quiz question answersCVE-2026-3225 · affects up to 4.3.2.8 · reported by WordfenceMedium 4.3
• Mar 11, 2026LearnPress – WordPress LMS: Unauthorized email notification triggeringCVE-2026-3226 · affects up to 4.3.2.8 · reported by WordfenceMedium 4.3
• Jan 19, 2026LearnPress – WordPress LMS: Sensitive Information ExposureCVE-2025-14798 · affects up to 4.3.2.4 · reported by WordfenceMedium 5.3
• Jan 7, 2026LearnPress – WordPress LMS: Unauthorized file deletionCVE-2025-14802 · affects up to 4.3.2.2 · reported by WordfenceMedium 5.4
• Jan 6, 2026LearnPress – WordPress LMS: Unauthorized modification of dataCVE-2025-13964 · affects up to 4.3.2 · reported by WordfenceMedium 5.3
• Dec 18, 2025LearnPress: Missing AuthorizationCVE-2025-66054 · affects up to 4.2.9.4 · reported by PatchstackHigh 7.5
• Dec 16, 2025LearnPress – WordPress LMS: Unauthorized access of dataCVE-2025-13956 · affects up to 4.3.1 · reported by WordfenceMedium 5.3
• Dec 15, 2025LearnPress – WordPress LMS: Stored Cross-Site ScriptingCVE-2025-14387 · affects up to 4.3.1 · reported by WordfenceMedium 6.4
• Dec 9, 2025LearnPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-67536 · affects up to 4.2.9.4 · reported by PatchstackMedium 6.5
• Nov 21, 2025LearnPress – WordPress LMS: Sensitive Information DisclosureCVE-2025-11368 · affects up to 4.2.9.4 · reported by Wordfence1.0% oddsMedium 5.3
• Oct 18, 2025LearnPress – WordPress LMS: Modification of dataCVE-2025-11372 · affects up to 4.2.9.2 · reported by WordfenceMedium 6.5
• May 15, 2025LearnPress: Does not sanitise and escape some of its settingsCVE-2024-13128 · fixed in 4.2.7.5.1 · reported by WPScanMedium 4.8
• May 15, 2025LearnPress: Does not sanitise and escape some of its settingsCVE-2024-13127 · fixed in 4.2.7.5.1 · reported by WPScanMedium 4.8
• Mar 27, 2025LearnPress: Missing AuthorizationCVE-2025-22739 · affects up to 4.2.7.5 · reported by PatchstackMedium 5.3
• Jan 27, 2025LearnPress: URL Redirection to Untrusted Site ('Open Redirect')CVE-2025-24740 · affects up to 4.2.7.1 · reported by PatchstackMedium 4.7
• Jan 25, 2025LearnPress – WordPress LMS: Stored Cross-Site ScriptingCVE-2024-13599 · affects up to 4.2.7.5 · reported by WordfenceMedium 6.4
• Dec 12, 2024LearnPress: Does not sanitise and escape some of its settingsCVE-2024-9881 · fixed in 4.2.7.2 · reported by WPScanMedium 4.8
• Dec 12, 2024LearnPress: Does not sanitise and escape some of its settingsCVE-2024-10010 · fixed in 4.2.7.2 · reported by WPScanMedium 4.8
• Dec 10, 2024LearnPress – WordPress LMS: Sensitive Information ExposureCVE-2024-11868 · affects up to 4.2.7.3 · reported by Wordfence1.2% oddsMedium 5.3
• Sep 12, 2024LearnPress – WordPress LMS: SQL InjectionCVE-2024-8529 · affects up to 4.2.7 · reported by Wordfence12% oddsCritical 10
• Sep 12, 2024LearnPress – WordPress LMS: SQL InjectionCVE-2024-8522 · affects up to 4.2.7 · reported by Wordfence63% oddsCritical 10
• Aug 26, 2024LearnPress: Cross-Site Request Forgery (CSRF)CVE-2024-39641 · affects up to 4.2.6.8.2 · reported by PatchstackMedium 4.3
• Aug 13, 2024LearnPress: Authorization Bypass Through User-Controlled KeyCVE-2024-39642 · affects up to 4.2.6.8.2 · reported by PatchstackMedium 6.5
• Aug 8, 2024LearnPress – WordPress LMS: Time-based SQL InjectionCVE-2024-7548 · affects up to 4.2.6.9.3 · reported by WordfenceHigh 8.8
• Jul 25, 2024LearnPress – WordPress LMS: Local File InclusionCVE-2024-6589 · affects up to 4.2.6.8.2 · reported by WordfenceHigh 8.8
• Jul 2, 2024LearnPress – WordPress LMS: Unauthenticated bypass to user registrationCVE-2024-6099 · affects up to 4.2.6.8.1 · reported by WordfenceMedium 5.3
• Jul 2, 2024LearnPress – WordPress LMS: Unauthorized user registrationCVE-2024-6088 · affects up to 4.2.6.8.1 · reported by WordfenceMedium 5.3
• Jun 19, 2024LearnPress: Missing AuthorizationCVE-2023-36516 · affects up to 4.2.3 · reported by PatchstackHigh 7.6
• Jun 19, 2024LearnPress: Missing AuthorizationCVE-2023-36515 · affects up to 4.2.3 · reported by PatchstackHigh 7.3
• Jun 4, 2024LearnPress – WordPress LMS: Sensitive Information ExposureCVE-2024-5483 · affects up to 4.2.6.8 · reported by Wordfence1.0% oddsMedium 5.3
• May 22, 2024LearnPress – WordPress LMS: Reflected Cross-Site ScriptingCVE-2024-4971 · affects up to 4.2.6.6 · reported by WordfenceMedium 6.4
• May 14, 2024LearnPress – WordPress LMS: Bypass to user registrationCVE-2024-4444 · affects up to 4.2.6.5 · reported by WordfenceMedium 5.3
• May 14, 2024LearnPress – WordPress LMS: Time-based SQL InjectionCVE-2024-4434 · affects up to 4.2.6.5 · reported by Wordfence37% oddsCritical 9.8
• May 14, 2024LearnPress – WordPress LMS: Arbitrary file uploadsCVE-2024-4397 · affects up to 4.2.6.5 · reported by Wordfence1.0% oddsHigh 8.8
• May 14, 2024LearnPress – WordPress LMS: Stored Cross-Site ScriptingCVE-2024-4277 · affects up to 4.2.6.5 · reported by WordfenceMedium 6.4
• Apr 18, 2024LearnPress – WordPress LMS: Stored Cross-Site ScriptingCVE-2024-3560 · affects up to 4.2.6.4 · reported by WordfenceMedium 6.4
• Apr 9, 2024LearnPress – WordPress LMS: Stored Cross-Site ScriptingCVE-2024-1463 · affects up to 4.2.6.3 · reported by WordfenceMedium 4.4
• Apr 9, 2024LearnPress – WordPress LMS: Insecure Direct Object ReferenceCVE-2024-1289 · affects up to 4.2.6.3 · reported by WordfenceMedium 6.5
• Apr 5, 2024LearnPress – WordPress LMS: Cross-Site Request ForgeryCVE-2024-2115 · affects up to 4.0.0 · reported by WordfenceHigh 8.8
• Jan 16, 2024LearnPress: Does not sanitise and escape user input before outputting it back in the pageCVE-2023-5558 · fixed in 4.2.5.5 · reported by WPScanMedium 6.1
• Jan 11, 2024LearnPress: Command InjectionCVE-2023-6634 · affects up to 4.2.5.7 · reported by Wordfence8.5% oddsHigh 8.1
• Jan 11, 2024LearnPress: Time-based SQL InjectionCVE-2023-6567 · affects up to 4.2.5.7 · reported by Wordfence51% oddsCritical 9.8
• Jan 11, 2024LearnPress: Insecure Direct Object ReferenceCVE-2023-6223 · affects up to 4.2.5.7 · reported by WordfenceMedium 4.3
• Jan 26, 2023Local File Inclusion vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions.CVE-2022-47615 · affects up to 4.1.7.3.2 · reported by Patchstack5.1% oddsCritical 9.3
• Jan 26, 2023SQL Injection (SQLi) vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions.CVE-2022-45820 · affects up to 4.1.7.3.2 · reported by Patchstack1.0% oddsCritical 9.1
• Jan 26, 2023SQL Injection vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions.CVE-2022-45808 · affects up to 4.1.7.3.2 · reported by Patchstack4.3% oddsCritical 9.9
• Oct 31, 2022LearnPress: Unserialises user input in a REST API endpoint available to unauthenticated usersCVE-2022-3360 · fixed in 4.1.7.2 · reported by WPScan2.6% oddsHigh 8.1
• Apr 11, 2022LearnPress: Does not sanitise and escape the lp-dismiss-notice before outputting it back via the lp_background_single_email AJAX actionCVE-2022-0271 · fixed in 4.1.6 · reported by WPScan1.9% oddsMedium 6.1
• Feb 28, 2022Users of the LearnPress WordPress plugin before 4.1.5 can upload an image as a profile avatar after the registration.CVE-2022-0377 · fixed in 4.1.5 · reported by WPScan3.2% oddsMedium 4.3
• Dec 13, 2021LearnPress: Does not sanitiseCVE-2021-24951 · fixed in 4.1.4 · reported by WPScan1.6% oddsCritical 9.8
• Oct 21, 2021LearnPress: Stored Cross-Site ScriptingCVE-2021-39348 · affects up to 4.1.3.1 · reported by Wordfence5.2% oddsMedium 5.5
• Oct 18, 2021LearnPress: Does not properly sanitize or escape various inputs within course settingsCVE-2021-24702 · fixed in 4.1.3.1 · reported by WPScanMedium 4.8
• Jul 30, 2021The LearnPress plugin before 3.2.6.9 for WordPress allows remote attackers to escalate the privileges of any user to LP Instructor via the accept-to-be-teacher CVE-2020-11511 · fixed in 3.2.6.9 · reported by MITRE3.2% oddsHigh 8.1
• Apr 30, 2020LearnPress Wordpress plugin version prior and including 3.2.6.7 is vulnerable to SQL InjectionCVE-2020-6010 · affects up to 3.2.6.7 · reported by cve@checkpoint.com49% oddsHigh 8.8
• Mar 16, 2020be_teacher in class-lp-admin-ajax.php in the LearnPress plugin 3.2.6.5 and earlier for WordPress allows any registered user to assign itself the teacher role viCVE-2020-7916 · affects up to 3.2.6.5 · reported by MITRE1.1% oddsMedium 6.5
• Jan 9, 2019the LearnPress prior to version 3.1.0: SQL injectionCVE-2018-16175 · fixed in 3.1.0 · reported by vultures@jpcert.or.jp1.3% oddsHigh 7.2
• Jan 9, 2019LearnPress prior to version 3.1.0: Open redirectCVE-2018-16174 · fixed in 3.1.0 · reported by vultures@jpcert.or.jp1.0% oddsMedium 6.1
• Jan 9, 2019LearnPress prior to version 3.1.0: Cross-site scriptingCVE-2018-16173 · fixed in 3.1.0 · reported by vultures@jpcert.or.jpMedium 6.1

Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.