WordPress security by component
LearnPress
Plugin description
LearnPress is a WordPress component with 67 published CVE records in this archive. The latest tracked vulnerability was published Jul 20, 2026; the highest CVE/CNA score is 10.
Plugin slug:
learnpressLatest vulnerability
CVE-2026-12970: LearnPress: Cross-site scripting
LearnPress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is < 4.4.1.
| Safe version |
|
||
|---|---|---|---|
| Jul 20, 2026 |
CVE-2026-12970
LearnPress: Cross-site scripting
LearnPress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is < 4.4.1.
|
4.4.1 |
CVE7.1
NVDPending
|
| Jul 17, 2026 |
CVE-2026-13765
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: Sensitive information exposure
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses is affected by sensitive information exposure. The vulnerable path is reachable without authentication. Successful exploitation can disclose data that should not be available to the caller. The published affected range is <= 4.4.1.
|
> 4.4.1 |
CVE7.5
NVDPending
|
| Jul 01, 2026 |
CVE-2026-12732
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: Cross-site scripting
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 4.4.0.
|
> 4.4.0 |
CVE6.4
NVDPending
|
| Jul 01, 2026 |
CVE-2026-11988
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: A security weakness
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses is affected by a security weakness. Exploitation requires at least subscriber-level access. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 4.3.9.1.
|
> 4.3.9.1 |
CVE6.5
NVDPending
|
| Jun 17, 2026 |
CVE-2026-8383
LearnPress: A security weakness
LearnPress is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is < 4.3.7.
|
4.3.7 |
CVE5.3
NVDPending
|
| Jun 06, 2026 |
CVE-2026-8502
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: Sensitive information exposure
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses is affected by sensitive information exposure. The vulnerable path is reachable without authentication. Successful exploitation can disclose data that should not be available to the caller. The published affected range is <= 4.3.6.
|
> 4.3.6 |
CVE5.3
NVDPending
|
| Jun 01, 2026 |
CVE-2026-48865
LearnPress: Cross-site scripting
LearnPress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a through 4.3.6.
|
4.3.7 |
CVE7.1
NVDPending
|
| May 14, 2026 |
CVE-2026-7648
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: A security weakness
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses is affected by a security weakness. Exploitation requires at least subscriber-level access. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 4.3.5.
|
> 4.3.5 |
CVE4.3
NVDPending
|
| Apr 14, 2026 |
CVE-2026-4365
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: A security weakness
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 4.3.2.8.
|
> 4.3.2.8 |
CVE9.1
NVDPending
|
| Apr 08, 2026 |
CVE-2026-4333
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: Cross-site scripting
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 4.3.3.
|
> 4.3.3 |
CVE6.4
NVDPending
|
| Mar 23, 2026 |
CVE-2026-3225
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: A security weakness
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses is affected by a security weakness. Exploitation requires at least subscriber-level access. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 4.3.2.8.
|
> 4.3.2.8 |
CVE4.3
NVDPending
|
| Mar 12, 2026 |
CVE-2026-3226
LearnPress – WordPress LMS Plugin: A security weakness
LearnPress – WordPress LMS Plugin is affected by a security weakness. Exploitation requires at least subscriber-level access. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE4.3
NVDPending
|
| Jan 20, 2026 |
CVE-2025-14798
LearnPress – WordPress LMS: Sensitive information exposure
LearnPress – WordPress LMS is affected by sensitive information exposure. The vulnerable path is reachable without authentication. Successful exploitation can disclose data that should not be available to the caller.
|
See mitigation notes |
CVE5.3
NVDPending
|
| Jan 07, 2026 |
CVE-2025-14802
LearnPress – WordPress LMS: A security weakness
LearnPress – WordPress LMS is affected by a security weakness. Exploitation requires an authenticated WordPress account. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.4
NVDPending
|
| Jan 06, 2026 |
CVE-2025-13964
LearnPress – WordPress LMS Plugin: A security weakness
LearnPress – WordPress LMS Plugin is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.3
NVDPending
|
| Dec 18, 2025 |
CVE-2025-66054
LearnPress: A security weakness
LearnPress is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE7.5
NVDPending
|
| Dec 16, 2025 |
CVE-2025-13956
LearnPress – WordPress LMS Plugin: A security weakness
LearnPress – WordPress LMS Plugin is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.3
NVDPending
|
| Dec 09, 2025 |
CVE-2025-67536
LearnPress: Cross-site scripting
LearnPress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.5
NVDPending
|
| Nov 21, 2025 |
CVE-2025-11368
LearnPress – WordPress LMS Plugin: Sensitive information exposure
LearnPress – WordPress LMS Plugin is affected by sensitive information exposure. The vulnerable path is reachable without authentication. Successful exploitation can disclose data that should not be available to the caller.
|
See mitigation notes |
CVE5.3
NVDPending
|
| Oct 18, 2025 |
CVE-2025-11372
LearnPress – WordPress LMS Plugin: A security weakness
LearnPress – WordPress LMS Plugin is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE6.5
NVDPending
|
| May 15, 2025 |
CVE-2024-13128
LearnPress: Cross-site scripting
LearnPress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE4.8
NVDPending
|
| May 15, 2025 |
CVE-2024-13127
LearnPress: Cross-site scripting
LearnPress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE4.8
NVDPending
|
| Mar 27, 2025 |
CVE-2025-22739
LearnPress: A security weakness
LearnPress is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.3
NVDPending
|
| Jan 27, 2025 |
CVE-2025-24740
LearnPress: An open redirect
LearnPress is affected by an open redirect. Exposure depends on how the affected operation is made reachable by the site. A crafted link can redirect visitors from the trusted site to an attacker-controlled destination.
|
See mitigation notes |
CVE4.7
NVDPending
|
| Jan 25, 2025 |
CVE-2024-13599
LearnPress – WordPress LMS Plugin: Cross-site scripting
LearnPress – WordPress LMS Plugin is affected by cross-site scripting. Exploitation requires an authenticated WordPress account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVD5.4
|
| Dec 12, 2024 |
CVE-2024-9881
LearnPress: Cross-site scripting
LearnPress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE4.8
NVDPending
|
| Dec 12, 2024 |
CVE-2024-10010
LearnPress: Cross-site scripting
LearnPress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE4.8
NVDPending
|
| Dec 10, 2024 |
CVE-2024-11868
LearnPress – WordPress LMS Plugin: Sensitive information exposure
LearnPress – WordPress LMS Plugin is affected by sensitive information exposure. The vulnerable path is reachable without authentication. Successful exploitation can disclose data that should not be available to the caller.
|
See mitigation notes |
CVE5.3
NVDPending
|
| Sep 12, 2024 |
CVE-2024-8529
LearnPress – WordPress LMS Plugin: SQL injection
LearnPress – WordPress LMS Plugin is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE10.0
NVD7.5
|
| Sep 12, 2024 |
CVE-2024-8522
LearnPress – WordPress LMS Plugin: SQL injection
LearnPress – WordPress LMS Plugin is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE10.0
NVD7.5
|
| Aug 26, 2024 |
CVE-2024-39641
LearnPress: Cross-site request forgery
LearnPress is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
|
See mitigation notes |
CVE4.3
NVD8.8
|
| Aug 13, 2024 |
CVE-2024-39642
LearnPress: A security weakness
LearnPress is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE6.5
NVDPending
|
| Aug 08, 2024 |
CVE-2024-7548
LearnPress – WordPress LMS Plugin: SQL injection
LearnPress – WordPress LMS Plugin is affected by SQL injection. Exploitation requires at least contributor-level access. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE8.8
NVD6.5
|
| Jul 25, 2024 |
CVE-2024-6589
LearnPress – WordPress LMS Plugin: Filesystem traversal
LearnPress – WordPress LMS Plugin is affected by filesystem traversal. Exploitation requires at least contributor-level access. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.
|
See mitigation notes |
CVE8.8
NVDPending
|
| Jul 02, 2024 |
CVE-2024-6099
LearnPress – WordPress LMS Plugin: A security weakness
LearnPress – WordPress LMS Plugin is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.3
NVD5.3
|
| Jul 02, 2024 |
CVE-2024-6088
LearnPress – WordPress LMS Plugin: A security weakness
LearnPress – WordPress LMS Plugin is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.3
NVD5.3
|
| Jun 19, 2024 |
CVE-2023-36516
LearnPress: A security weakness
LearnPress is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE7.6
NVD8.8
|
| Jun 19, 2024 |
CVE-2023-36515
LearnPress: A security weakness
LearnPress is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE7.3
NVD9.8
|
| Jun 05, 2024 |
CVE-2024-5483
LearnPress – WordPress LMS Plugin: Sensitive information exposure
LearnPress – WordPress LMS Plugin is affected by sensitive information exposure. The vulnerable path is reachable without authentication. Successful exploitation can disclose data that should not be available to the caller.
|
See mitigation notes |
CVE5.3
NVDPending
|
| May 22, 2024 |
CVE-2024-4971
LearnPress – WordPress LMS Plugin: Cross-site scripting
LearnPress – WordPress LMS Plugin is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVD5.4
|
| May 14, 2024 |
CVE-2024-4444
LearnPress – WordPress LMS Plugin: A security weakness
LearnPress – WordPress LMS Plugin is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.3
NVD6.5
|
| May 14, 2024 |
CVE-2024-4434
LearnPress – WordPress LMS Plugin: SQL injection
LearnPress – WordPress LMS Plugin is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE9.8
NVDPending
|
| May 14, 2024 |
CVE-2024-4397
LearnPress – WordPress LMS Plugin: Dangerous file upload
LearnPress – WordPress LMS Plugin is affected by dangerous file upload. Exploitation requires an authenticated WordPress account. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.
|
See mitigation notes |
CVE8.8
NVDPending
|
| May 14, 2024 |
CVE-2024-4277
LearnPress – WordPress LMS Plugin: Cross-site scripting
LearnPress – WordPress LMS Plugin is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVD5.4
|
| Apr 19, 2024 |
CVE-2024-3560
LearnPress – WordPress LMS Plugin: Cross-site scripting
LearnPress – WordPress LMS Plugin is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.4
NVD5.4
|
| Apr 09, 2024 |
CVE-2024-1463
LearnPress – WordPress LMS Plugin: Cross-site scripting
LearnPress – WordPress LMS Plugin is affected by cross-site scripting. Exploitation requires an authenticated WordPress account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE4.4
NVD4.8
|
| Apr 09, 2024 |
CVE-2024-1289
LearnPress – WordPress LMS Plugin: A security weakness
LearnPress – WordPress LMS Plugin is affected by a security weakness. Exploitation requires an authenticated WordPress account. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE6.5
NVD5.4
|
| Apr 05, 2024 |
CVE-2024-2115
LearnPress – WordPress LMS Plugin: Cross-site request forgery
LearnPress – WordPress LMS Plugin is affected by cross-site request forgery. The vulnerable path is reachable without authentication. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
|
See mitigation notes |
CVE8.8
NVDPending
|
| Jan 16, 2024 |
CVE-2023-5558
LearnPress: Cross-site scripting
LearnPress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.1
NVD6.1
|
| Jan 11, 2024 |
CVE-2023-6634
LearnPress: Code execution
LearnPress is affected by code execution. The vulnerable path is reachable without authentication. Successful exploitation can run attacker-controlled code in the WordPress hosting account.
|
See mitigation notes |
CVE8.1
NVD9.8
|
| Jan 11, 2024 |
CVE-2023-6567
LearnPress: SQL injection
LearnPress is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE9.8
NVD7.5
|
| Jan 11, 2024 |
CVE-2023-6223
LearnPress: A security weakness
LearnPress is affected by a security weakness. Exploitation requires at least subscriber-level access. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE4.3
NVD4.3
|
| Jan 26, 2023 |
CVE-2022-47615
Learnpress: Filesystem traversal
Learnpress is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.
|
See mitigation notes |
CVE9.3
NVD9.8
|
| Jan 26, 2023 |
CVE-2022-45820
Learnpress: SQL injection
Learnpress is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE9.1
NVD8.8
|
| Jan 26, 2023 |
CVE-2022-45808
Learnpress: SQL injection
Learnpress is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE9.9
NVD9.8
|
| Oct 31, 2022 |
CVE-2022-3360
LearnPress: Code execution
LearnPress is affected by code execution. The vulnerable path is reachable without authentication. Successful exploitation can run attacker-controlled code in the WordPress hosting account.
|
See mitigation notes |
CVE8.1
NVD8.1
|
| Apr 11, 2022 |
CVE-2022-0271
LearnPress: Cross-site scripting
LearnPress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.1
NVD6.1
|
| Feb 28, 2022 |
CVE-2022-0377
LearnPress: A security weakness
LearnPress is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE4.3
NVD4.3
|
| Dec 13, 2021 |
CVE-2021-24951
LearnPress: SQL injection
LearnPress is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE9.8
NVD9.8
|
| Oct 21, 2021 |
CVE-2021-39348
LearnPress: Cross-site scripting
LearnPress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE5.5
NVD4.8
|
| Oct 18, 2021 |
CVE-2021-24702
LearnPress: Cross-site scripting
LearnPress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE4.8
NVD4.8
|
| Jul 30, 2021 |
CVE-2020-11511
Learnpress: A security weakness
Learnpress is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE8.1
NVD8.1
|
| Apr 30, 2020 |
CVE-2020-6010
Learnpress: SQL injection
Learnpress is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE8.8
NVD8.8
|
| Mar 16, 2020 |
CVE-2020-7916
Learnpress: A security weakness
Learnpress is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE6.5
NVD6.5
|
| Jan 09, 2019 |
CVE-2018-16175
Learnpress: SQL injection
Learnpress is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE7.2
NVD7.2
|
| Jan 09, 2019 |
CVE-2018-16174
Learnpress: An open redirect
Learnpress is affected by an open redirect. Exposure depends on how the affected operation is made reachable by the site. A crafted link can redirect visitors from the trusted site to an attacker-controlled destination.
|
See mitigation notes |
CVE6.1
NVD6.1
|
| Jan 09, 2019 |
CVE-2018-16173
Learnpress: Cross-site scripting
Learnpress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.1
NVD6.1
|