← WordPress Vulnerabilities
WordPress security by component

LearnPress

LearnPress is a WordPress component with 67 published CVE records in this archive. The latest tracked vulnerability was published Jul 20, 2026; the highest CVE/CNA score is 10.

Plugin slug: learnpress

CVE-2026-12970: LearnPress: Cross-site scripting

LearnPress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is < 4.4.1.

PublishedJul 20, 2026
Known safe version4.4.1
Safe version
Jul 20, 2026 CVE-2026-12970
LearnPress: Cross-site scripting
LearnPress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is < 4.4.1.
4.4.1
CVE7.1
NVDPending
Jul 17, 2026 CVE-2026-13765
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: Sensitive information exposure
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses is affected by sensitive information exposure. The vulnerable path is reachable without authentication. Successful exploitation can disclose data that should not be available to the caller. The published affected range is <= 4.4.1.
> 4.4.1
CVE7.5
NVDPending
Jul 01, 2026 CVE-2026-12732
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: Cross-site scripting
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 4.4.0.
> 4.4.0
CVE6.4
NVDPending
Jul 01, 2026 CVE-2026-11988
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: A security weakness
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses is affected by a security weakness. Exploitation requires at least subscriber-level access. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 4.3.9.1.
> 4.3.9.1
CVE6.5
NVDPending
Jun 17, 2026 CVE-2026-8383
LearnPress: A security weakness
LearnPress is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is < 4.3.7.
4.3.7
CVE5.3
NVDPending
Jun 06, 2026 CVE-2026-8502
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: Sensitive information exposure
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses is affected by sensitive information exposure. The vulnerable path is reachable without authentication. Successful exploitation can disclose data that should not be available to the caller. The published affected range is <= 4.3.6.
> 4.3.6
CVE5.3
NVDPending
Jun 01, 2026 CVE-2026-48865
LearnPress: Cross-site scripting
LearnPress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a through 4.3.6.
4.3.7
CVE7.1
NVDPending
May 14, 2026 CVE-2026-7648
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: A security weakness
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses is affected by a security weakness. Exploitation requires at least subscriber-level access. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 4.3.5.
> 4.3.5
CVE4.3
NVDPending
Apr 14, 2026 CVE-2026-4365
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: A security weakness
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 4.3.2.8.
> 4.3.2.8
CVE9.1
NVDPending
Apr 08, 2026 CVE-2026-4333
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: Cross-site scripting
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 4.3.3.
> 4.3.3
CVE6.4
NVDPending
Mar 23, 2026 CVE-2026-3225
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: A security weakness
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses is affected by a security weakness. Exploitation requires at least subscriber-level access. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 4.3.2.8.
> 4.3.2.8
CVE4.3
NVDPending
Mar 12, 2026 CVE-2026-3226
LearnPress – WordPress LMS Plugin: A security weakness
LearnPress – WordPress LMS Plugin is affected by a security weakness. Exploitation requires at least subscriber-level access. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE4.3
NVDPending
Jan 20, 2026 CVE-2025-14798
LearnPress – WordPress LMS: Sensitive information exposure
LearnPress – WordPress LMS is affected by sensitive information exposure. The vulnerable path is reachable without authentication. Successful exploitation can disclose data that should not be available to the caller.
See mitigation notes
CVE5.3
NVDPending
Jan 07, 2026 CVE-2025-14802
LearnPress – WordPress LMS: A security weakness
LearnPress – WordPress LMS is affected by a security weakness. Exploitation requires an authenticated WordPress account. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE5.4
NVDPending
Jan 06, 2026 CVE-2025-13964
LearnPress – WordPress LMS Plugin: A security weakness
LearnPress – WordPress LMS Plugin is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE5.3
NVDPending
Dec 18, 2025 CVE-2025-66054
LearnPress: A security weakness
LearnPress is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE7.5
NVDPending
Dec 16, 2025 CVE-2025-13956
LearnPress – WordPress LMS Plugin: A security weakness
LearnPress – WordPress LMS Plugin is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE5.3
NVDPending
Dec 09, 2025 CVE-2025-67536
LearnPress: Cross-site scripting
LearnPress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE6.5
NVDPending
Nov 21, 2025 CVE-2025-11368
LearnPress – WordPress LMS Plugin: Sensitive information exposure
LearnPress – WordPress LMS Plugin is affected by sensitive information exposure. The vulnerable path is reachable without authentication. Successful exploitation can disclose data that should not be available to the caller.
See mitigation notes
CVE5.3
NVDPending
Oct 18, 2025 CVE-2025-11372
LearnPress – WordPress LMS Plugin: A security weakness
LearnPress – WordPress LMS Plugin is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE6.5
NVDPending
May 15, 2025 CVE-2024-13128
LearnPress: Cross-site scripting
LearnPress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE4.8
NVDPending
May 15, 2025 CVE-2024-13127
LearnPress: Cross-site scripting
LearnPress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE4.8
NVDPending
Mar 27, 2025 CVE-2025-22739
LearnPress: A security weakness
LearnPress is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE5.3
NVDPending
Jan 27, 2025 CVE-2025-24740
LearnPress: An open redirect
LearnPress is affected by an open redirect. Exposure depends on how the affected operation is made reachable by the site. A crafted link can redirect visitors from the trusted site to an attacker-controlled destination.
See mitigation notes
CVE4.7
NVDPending
Jan 25, 2025 CVE-2024-13599
LearnPress – WordPress LMS Plugin: Cross-site scripting
LearnPress – WordPress LMS Plugin is affected by cross-site scripting. Exploitation requires an authenticated WordPress account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE6.4
NVD5.4
Dec 12, 2024 CVE-2024-9881
LearnPress: Cross-site scripting
LearnPress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE4.8
NVDPending
Dec 12, 2024 CVE-2024-10010
LearnPress: Cross-site scripting
LearnPress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE4.8
NVDPending
Dec 10, 2024 CVE-2024-11868
LearnPress – WordPress LMS Plugin: Sensitive information exposure
LearnPress – WordPress LMS Plugin is affected by sensitive information exposure. The vulnerable path is reachable without authentication. Successful exploitation can disclose data that should not be available to the caller.
See mitigation notes
CVE5.3
NVDPending
Sep 12, 2024 CVE-2024-8529
LearnPress – WordPress LMS Plugin: SQL injection
LearnPress – WordPress LMS Plugin is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.
See mitigation notes
CVE10.0
NVD7.5
Sep 12, 2024 CVE-2024-8522
LearnPress – WordPress LMS Plugin: SQL injection
LearnPress – WordPress LMS Plugin is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.
See mitigation notes
CVE10.0
NVD7.5
Aug 26, 2024 CVE-2024-39641
LearnPress: Cross-site request forgery
LearnPress is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
See mitigation notes
CVE4.3
NVD8.8
Aug 13, 2024 CVE-2024-39642
LearnPress: A security weakness
LearnPress is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE6.5
NVDPending
Aug 08, 2024 CVE-2024-7548
LearnPress – WordPress LMS Plugin: SQL injection
LearnPress – WordPress LMS Plugin is affected by SQL injection. Exploitation requires at least contributor-level access. A successful request can alter database queries and expose or modify WordPress data.
See mitigation notes
CVE8.8
NVD6.5
Jul 25, 2024 CVE-2024-6589
LearnPress – WordPress LMS Plugin: Filesystem traversal
LearnPress – WordPress LMS Plugin is affected by filesystem traversal. Exploitation requires at least contributor-level access. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.
See mitigation notes
CVE8.8
NVDPending
Jul 02, 2024 CVE-2024-6099
LearnPress – WordPress LMS Plugin: A security weakness
LearnPress – WordPress LMS Plugin is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE5.3
NVD5.3
Jul 02, 2024 CVE-2024-6088
LearnPress – WordPress LMS Plugin: A security weakness
LearnPress – WordPress LMS Plugin is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE5.3
NVD5.3
Jun 19, 2024 CVE-2023-36516
LearnPress: A security weakness
LearnPress is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE7.6
NVD8.8
Jun 19, 2024 CVE-2023-36515
LearnPress: A security weakness
LearnPress is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE7.3
NVD9.8
Jun 05, 2024 CVE-2024-5483
LearnPress – WordPress LMS Plugin: Sensitive information exposure
LearnPress – WordPress LMS Plugin is affected by sensitive information exposure. The vulnerable path is reachable without authentication. Successful exploitation can disclose data that should not be available to the caller.
See mitigation notes
CVE5.3
NVDPending
May 22, 2024 CVE-2024-4971
LearnPress – WordPress LMS Plugin: Cross-site scripting
LearnPress – WordPress LMS Plugin is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE6.4
NVD5.4
May 14, 2024 CVE-2024-4444
LearnPress – WordPress LMS Plugin: A security weakness
LearnPress – WordPress LMS Plugin is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE5.3
NVD6.5
May 14, 2024 CVE-2024-4434
LearnPress – WordPress LMS Plugin: SQL injection
LearnPress – WordPress LMS Plugin is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.
See mitigation notes
CVE9.8
NVDPending
May 14, 2024 CVE-2024-4397
LearnPress – WordPress LMS Plugin: Dangerous file upload
LearnPress – WordPress LMS Plugin is affected by dangerous file upload. Exploitation requires an authenticated WordPress account. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.
See mitigation notes
CVE8.8
NVDPending
May 14, 2024 CVE-2024-4277
LearnPress – WordPress LMS Plugin: Cross-site scripting
LearnPress – WordPress LMS Plugin is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE6.4
NVD5.4
Apr 19, 2024 CVE-2024-3560
LearnPress – WordPress LMS Plugin: Cross-site scripting
LearnPress – WordPress LMS Plugin is affected by cross-site scripting. Exploitation requires at least contributor-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE6.4
NVD5.4
Apr 09, 2024 CVE-2024-1463
LearnPress – WordPress LMS Plugin: Cross-site scripting
LearnPress – WordPress LMS Plugin is affected by cross-site scripting. Exploitation requires an authenticated WordPress account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE4.4
NVD4.8
Apr 09, 2024 CVE-2024-1289
LearnPress – WordPress LMS Plugin: A security weakness
LearnPress – WordPress LMS Plugin is affected by a security weakness. Exploitation requires an authenticated WordPress account. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE6.5
NVD5.4
Apr 05, 2024 CVE-2024-2115
LearnPress – WordPress LMS Plugin: Cross-site request forgery
LearnPress – WordPress LMS Plugin is affected by cross-site request forgery. The vulnerable path is reachable without authentication. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
See mitigation notes
CVE8.8
NVDPending
Jan 16, 2024 CVE-2023-5558
LearnPress: Cross-site scripting
LearnPress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE6.1
NVD6.1
Jan 11, 2024 CVE-2023-6634
LearnPress: Code execution
LearnPress is affected by code execution. The vulnerable path is reachable without authentication. Successful exploitation can run attacker-controlled code in the WordPress hosting account.
See mitigation notes
CVE8.1
NVD9.8
Jan 11, 2024 CVE-2023-6567
LearnPress: SQL injection
LearnPress is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.
See mitigation notes
CVE9.8
NVD7.5
Jan 11, 2024 CVE-2023-6223
LearnPress: A security weakness
LearnPress is affected by a security weakness. Exploitation requires at least subscriber-level access. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE4.3
NVD4.3
Jan 26, 2023 CVE-2022-47615
Learnpress: Filesystem traversal
Learnpress is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.
See mitigation notes
CVE9.3
NVD9.8
Jan 26, 2023 CVE-2022-45820
Learnpress: SQL injection
Learnpress is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.
See mitigation notes
CVE9.1
NVD8.8
Jan 26, 2023 CVE-2022-45808
Learnpress: SQL injection
Learnpress is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.
See mitigation notes
CVE9.9
NVD9.8
Oct 31, 2022 CVE-2022-3360
LearnPress: Code execution
LearnPress is affected by code execution. The vulnerable path is reachable without authentication. Successful exploitation can run attacker-controlled code in the WordPress hosting account.
See mitigation notes
CVE8.1
NVD8.1
Apr 11, 2022 CVE-2022-0271
LearnPress: Cross-site scripting
LearnPress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE6.1
NVD6.1
Feb 28, 2022 CVE-2022-0377
LearnPress: A security weakness
LearnPress is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE4.3
NVD4.3
Dec 13, 2021 CVE-2021-24951
LearnPress: SQL injection
LearnPress is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.
See mitigation notes
CVE9.8
NVD9.8
Oct 21, 2021 CVE-2021-39348
LearnPress: Cross-site scripting
LearnPress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE5.5
NVD4.8
Oct 18, 2021 CVE-2021-24702
LearnPress: Cross-site scripting
LearnPress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE4.8
NVD4.8
Jul 30, 2021 CVE-2020-11511
Learnpress: A security weakness
Learnpress is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE8.1
NVD8.1
Apr 30, 2020 CVE-2020-6010
Learnpress: SQL injection
Learnpress is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.
See mitigation notes
CVE8.8
NVD8.8
Mar 16, 2020 CVE-2020-7916
Learnpress: A security weakness
Learnpress is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
See mitigation notes
CVE6.5
NVD6.5
Jan 09, 2019 CVE-2018-16175
Learnpress: SQL injection
Learnpress is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.
See mitigation notes
CVE7.2
NVD7.2
Jan 09, 2019 CVE-2018-16174
Learnpress: An open redirect
Learnpress is affected by an open redirect. Exposure depends on how the affected operation is made reachable by the site. A crafted link can redirect visitors from the trusted site to an attacker-controlled destination.
See mitigation notes
CVE6.1
NVD6.1
Jan 09, 2019 CVE-2018-16173
Learnpress: Cross-site scripting
Learnpress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
See mitigation notes
CVE6.1
NVD6.1