WordPress security by component

LearnPress – WordPress LMS Plugin

Plugin description

LearnPress – WordPress LMS Plugin creates and manages online courses, lessons, quizzes, instructors, enrollments, and student learning content within WordPress.

LearnPress – WordPress LMS Plugin (learnpress) is a WordPress plugin with 81 published CVE records in this archive. The latest tracked vulnerability was published Sep 17, 2026; the highest published CVSS base score is 10.

Plugin slug: learnpress

Latest vulnerability

CVE-2026-86446: LearnPress exposes quiz answers on courses that allow unenrolled access

LearnPress from 4.4.3 up to but not including 4.4.7 returns unrestricted correctness flags when checking a quiz answer. On courses configured to be taken without enrolling, an unauthenticated requester can obtain the correct-answer status for every option of a question plus the instructor's explanation. The export does not name the answer-check endpoint, fields or handler. The disclosed access depends on that course configuration, not all private courses.

PublishedSep 17, 2026

Known safe version4.4.7

Published vulnerabilities for learnpress
		Safe version
Sep 17, 2026	CVE-2026-86446 LearnPress exposes quiz answers on courses that allow unenrolled access LearnPress from 4.4.3 up to but not including 4.4.7 returns unrestricted correctness flags when checking a quiz answer. On courses configured to be taken without enrolling, an unauthenticated requester can obtain the correct-answer status for every option of a question plus the instructor's explanation. The export does not name the answer-check endpoint, fields or handler. The disclosed access depends on that course configuration, not all private courses.	4.4.7	CVE3.7 NVDPending
Sep 16, 2026	CVE-2026-86449 LearnPress allows unauthenticated listing of unpublished courses LearnPress from 4.2.7.1 up to but not including 4.4.7: A public REST route applies a caller-supplied post-status filter without checking capabilities. An unauthenticated requester can list draft, pending, private, scheduled and trashed courses. The export does not disclose the route, filter parameter or exact response fields, so full course-body disclosure is not established.	4.4.7	CVE5.3 NVDPending
Sep 16, 2026	CVE-2026-86448 LearnPress allows unauthenticated downloads of generated order exports LearnPress from 4.3.2.8 up to but not including 4.4.7: An unauthenticated attacker who determines an existing export identifier can download a previously generated order-export file. No authentication, capability or nonce check protects delivery. Exposed data includes customer names, purchases, amounts and guest email addresses. The export does not explain how identifiers are obtained or name the download route or identifier field.	4.4.7	CVE3.7 NVDPending
Sep 16, 2026	CVE-2026-86447 LearnPress exposes student enrollment and email information LearnPress from 4.4.6 up to but not including 4.4.7: An unauthenticated requester can invoke an administrative course tool that omits capability checks. The response lists enrolled students' display names and user IDs with their courses; the same handler's search filter can reveal email addresses. The export does not name the handler, action or search parameter.	4.4.7	CVE5.3 NVDPending
Sep 16, 2026	CVE-2026-86445 LearnPress exposes non-public quiz questions through an admin handler LearnPress from 4.2.9 up to but not including 4.4.7: An unauthenticated requester can use an administrative template handler without capability checks to retrieve the text, identifier and type of every published quiz question and search them by keyword. These question contents are otherwise non-public. The export does not name the handler, route or search field.	4.4.7	CVE5.3 NVDPending
Sep 16, 2026	CVE-2026-86444 LearnPress reflects input into a public-page HTML attribute LearnPress from 4.2.6.4 up to but not including 4.4.7: On a site using a classic, non-block theme, an unauthenticated attacker can craft a link containing a value rendered unescaped in an HTML attribute. A visitor who opens it can execute attacker-supplied JavaScript under the site's origin, including within a logged-in administrator's session. The export does not name the route, parameter or rendering function.	4.4.7	CVE7.1 NVDPending
Sep 08, 2026	CVE-2026-12230 LearnPress permits contributors to store scripts through layout_custom_css LearnPress through 4.3.9.1 does not adequately sanitize and escape layout_custom_css. A Contributor or higher-privileged user can inject scripts through that parameter, and the scripts execute when another user accesses a page rendering the injected content.	See mitigation notes	CVE6.4 NVDPending
Sep 03, 2026	CVE-2026-82024 LearnPress instructors can store script in quiz answer titles LearnPress before 4.4.6 allows an Instructor to submit an unsanitized quiz-question answer title. The title is stored and rendered without adequate escaping, allowing persistent JavaScript to execute when students, instructors, or administrators view the affected question.	4.4.6	CVE5.1 NVDPending
Sep 03, 2026	CVE-2026-82023 LearnPress instructors can modify questions owned by other instructors LearnPress before 4.4.6 does not verify question ownership when an Instructor adds a quiz answer. An Instructor can submit another instructor's question identifier and persistently modify quiz content outside their own courses.	4.4.6	CVE5.3 NVDPending
Sep 01, 2026	CVE-2026-77823 LearnPress order export permits Administrator-level SQL injection LearnPress through 4.4.4 accepts an attacker-controlled orderby value in the export_order_csv AJAX action. LP_Order::handle_params_query_list_orders() normalizes only date and title; other values flow through DataBase::execute() into the ORDER BY clause without an identifier allowlist or prepared query, allowing an Administrator to extract sensitive database information.	See mitigation notes	CVE4.9 NVDPending
Aug 27, 2026	CVE-2026-78125 LearnPress exposes arbitrary order payment status LearnPress before 4.0.3 exposes a REST endpoint without an authorization check. An unauthenticated attacker can enumerate order identifiers and retrieve the payment status of arbitrary orders.	4.0.3	CVE5.3 NVDPending
Aug 25, 2026	CVE-2026-75982 LearnPress lets Editors modify arbitrary WordPress options LearnPress through 4.4.4 lets an Editor or higher call the learnpress_create_page AJAX action. LP_Admin_Ajax::create_page() accepts attacker-controlled field_name as an option key and LP_Helper::create_page() passes it to update_option(), allowing a positive page ID to replace arbitrary site-wide settings, including users_can_register or active_plugins.	See mitigation notes	CVE4.4 NVDPending
Aug 12, 2026	CVE-2026-12976 LearnPress AI assistant exposes paid lesson content to Subscribers LearnPress before 4.4.4 processes AI-assistant requests against lesson content without verifying that the requester is enrolled in the course. Any authenticated user, including a Subscriber, can target a paid course they have not joined and obtain its lesson material.	4.4.4	CVE6.5 NVDPending
Aug 10, 2026	CVE-2026-12971 LearnPress OpenAI image operation permits blind SSRF LearnPress before 4.4.4 exposes an operation named openai_apply_image_feature that accepts a supplied URL and fetches it from the WordPress server without adequate validation. An Instructor or higher role can cause blind requests to arbitrary external hosts.	4.4.4	CVE2.2 NVDPending
Jul 20, 2026	CVE-2026-12970 LearnPress: Cross-site scripting LearnPress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is < 4.4.1.	4.4.1	CVE7.1 NVDPending
Jul 17, 2026	CVE-2026-13765 LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: Sensitive information exposure LearnPress – WordPress LMS Plugin for Create and Sell Online Courses is affected by sensitive information exposure. The vulnerable path is reachable without authentication. Successful exploitation can disclose data that should not be available to the caller. The published affected range is <= 4.4.1.	See mitigation notes	CVE7.5 NVDPending
Jul 01, 2026	CVE-2026-12732 LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: Cross-site scripting LearnPress – WordPress LMS Plugin for Create and Sell Online Courses is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 4.4.0.	See mitigation notes	CVE6.4 NVDPending
Jul 01, 2026	CVE-2026-11988 LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: Broken access control LearnPress – WordPress LMS Plugin for Create and Sell Online Courses is affected by broken access control. Exploitation requires an authenticated subscriber account. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is <= 4.3.9.1.	See mitigation notes	CVE6.5 NVDPending
Jun 17, 2026	CVE-2026-8383 LearnPress: A security weakness LearnPress is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is < 4.3.7.	4.3.7	CVE5.3 NVDPending
Jun 06, 2026	CVE-2026-8502 LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: Sensitive information exposure LearnPress – WordPress LMS Plugin for Create and Sell Online Courses is affected by sensitive information exposure. The vulnerable path is reachable without authentication. Successful exploitation can disclose data that should not be available to the caller. The published affected range is <= 4.3.6.	See mitigation notes	CVE5.3 NVDPending
Jun 01, 2026	CVE-2026-48865 LearnPress: Cross-site scripting LearnPress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a through 4.3.6.	4.3.7	CVE7.1 NVDPending
May 14, 2026	CVE-2026-7648 LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: A security weakness LearnPress – WordPress LMS Plugin for Create and Sell Online Courses is affected by a security weakness. Exploitation requires an authenticated subscriber account. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 4.3.5.	See mitigation notes	CVE4.3 NVDPending
Apr 14, 2026	CVE-2026-4365 LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: A security weakness LearnPress – WordPress LMS Plugin for Create and Sell Online Courses is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 4.3.2.8.	See mitigation notes	CVE9.1 NVDPending
Apr 08, 2026	CVE-2026-4333 LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: Cross-site scripting LearnPress – WordPress LMS Plugin for Create and Sell Online Courses is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 4.3.3.	See mitigation notes	CVE6.4 NVDPending
Mar 23, 2026	CVE-2026-3225 LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: A security weakness LearnPress – WordPress LMS Plugin for Create and Sell Online Courses is affected by a security weakness. Exploitation requires an authenticated subscriber account. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 4.3.2.8.	See mitigation notes	CVE4.3 NVDPending
Mar 12, 2026	CVE-2026-3226 LearnPress – WordPress LMS Plugin: A security weakness LearnPress – WordPress LMS Plugin is affected by a security weakness. Exploitation requires an authenticated subscriber account. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE4.3 NVDPending
Jan 20, 2026	CVE-2025-14798 LearnPress – WordPress LMS: Sensitive information exposure LearnPress – WordPress LMS is affected by sensitive information exposure. The vulnerable path is reachable without authentication. Successful exploitation can disclose data that should not be available to the caller.	See mitigation notes	CVE5.3 NVDPending
Jan 07, 2026	CVE-2025-14802 LearnPress – WordPress LMS: A security weakness LearnPress – WordPress LMS is affected by a security weakness. Exploitation requires an authenticated WordPress account. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.4 NVDPending
Jan 06, 2026	CVE-2025-13964 LearnPress – WordPress LMS Plugin: A security weakness LearnPress – WordPress LMS Plugin is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3 NVDPending
Dec 18, 2025	CVE-2025-66054 LearnPress: A security weakness LearnPress is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE7.5 NVDPending
Dec 16, 2025	CVE-2025-13956 LearnPress – WordPress LMS Plugin: A security weakness LearnPress – WordPress LMS Plugin is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3 NVDPending
Dec 09, 2025	CVE-2025-67536 LearnPress: Cross-site scripting LearnPress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.5 NVDPending
Nov 21, 2025	CVE-2025-11368 LearnPress – WordPress LMS Plugin: Sensitive information exposure LearnPress – WordPress LMS Plugin is affected by sensitive information exposure. The vulnerable path is reachable without authentication. Successful exploitation can disclose data that should not be available to the caller.	See mitigation notes	CVE5.3 NVDPending
Oct 18, 2025	CVE-2025-11372 LearnPress – WordPress LMS Plugin: A security weakness LearnPress – WordPress LMS Plugin is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE6.5 NVDPending
May 15, 2025	CVE-2024-13128 LearnPress: Cross-site scripting LearnPress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE4.8 NVDPending
May 15, 2025	CVE-2024-13127 LearnPress: Cross-site scripting LearnPress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE4.8 NVDPending
Mar 27, 2025	CVE-2025-22739 LearnPress: A security weakness LearnPress is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3 NVDPending
Jan 27, 2025	CVE-2025-24740 LearnPress: An open redirect LearnPress is affected by an open redirect. Exposure depends on how the affected operation is made reachable by the site. A crafted link can redirect visitors from the trusted site to an attacker-controlled destination.	See mitigation notes	CVE4.7 NVDPending
Jan 25, 2025	CVE-2024-13599 LearnPress – WordPress LMS Plugin: Cross-site scripting LearnPress – WordPress LMS Plugin is affected by cross-site scripting. Exploitation requires an authenticated WordPress account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4 NVD5.4
Dec 12, 2024	CVE-2024-9881 LearnPress: Cross-site scripting LearnPress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE4.8 NVDPending
Dec 12, 2024	CVE-2024-10010 LearnPress: Cross-site scripting LearnPress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE4.8 NVDPending
Dec 10, 2024	CVE-2024-11868 LearnPress – WordPress LMS Plugin: Sensitive information exposure LearnPress – WordPress LMS Plugin is affected by sensitive information exposure. The vulnerable path is reachable without authentication. Successful exploitation can disclose data that should not be available to the caller.	See mitigation notes	CVE5.3 NVDPending
Sep 12, 2024	CVE-2024-8529 LearnPress – WordPress LMS Plugin: SQL injection LearnPress – WordPress LMS Plugin is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE10.0 NVD7.5
Sep 12, 2024	CVE-2024-8522 LearnPress – WordPress LMS Plugin: SQL injection LearnPress – WordPress LMS Plugin is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE10.0 NVD7.5
Aug 26, 2024	CVE-2024-39641 LearnPress: Cross-site request forgery LearnPress is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.	See mitigation notes	CVE4.3 NVD8.8
Aug 13, 2024	CVE-2024-39642 LearnPress: A security weakness LearnPress is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE6.5 NVDPending
Aug 08, 2024	CVE-2024-7548 LearnPress – WordPress LMS Plugin: SQL injection LearnPress – WordPress LMS Plugin is affected by SQL injection. Exploitation requires an authenticated contributor account. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE8.8 NVD6.5
Jul 25, 2024	CVE-2024-6589 LearnPress – WordPress LMS Plugin: Filesystem traversal LearnPress – WordPress LMS Plugin is affected by filesystem traversal. Exploitation requires an authenticated contributor account. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.	See mitigation notes	CVE8.8 NVDPending
Jul 02, 2024	CVE-2024-6099 LearnPress – WordPress LMS Plugin: A security weakness LearnPress – WordPress LMS Plugin is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3 NVD5.3
Jul 02, 2024	CVE-2024-6088 LearnPress – WordPress LMS Plugin: A security weakness LearnPress – WordPress LMS Plugin is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3 NVD5.3
Jun 19, 2024	CVE-2023-36516 LearnPress: A security weakness LearnPress is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE7.6 NVD8.8
Jun 19, 2024	CVE-2023-36515 LearnPress: A security weakness LearnPress is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE7.3 NVD9.8
Jun 05, 2024	CVE-2024-5483 LearnPress – WordPress LMS Plugin: Sensitive information exposure LearnPress – WordPress LMS Plugin is affected by sensitive information exposure. The vulnerable path is reachable without authentication. Successful exploitation can disclose data that should not be available to the caller.	See mitigation notes	CVE5.3 NVDPending
May 22, 2024	CVE-2024-4971 LearnPress – WordPress LMS Plugin: Cross-site scripting LearnPress – WordPress LMS Plugin is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4 NVD5.4
May 14, 2024	CVE-2024-4444 LearnPress – WordPress LMS Plugin: A security weakness LearnPress – WordPress LMS Plugin is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3 NVD6.5
May 14, 2024	CVE-2024-4434 LearnPress – WordPress LMS Plugin: SQL injection LearnPress – WordPress LMS Plugin is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE9.8 NVDPending
May 14, 2024	CVE-2024-4397 LearnPress – WordPress LMS Plugin: Dangerous file upload LearnPress – WordPress LMS Plugin is affected by dangerous file upload. Exploitation requires an authenticated WordPress account. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.	See mitigation notes	CVE8.8 NVDPending
May 14, 2024	CVE-2024-4277 LearnPress – WordPress LMS Plugin: Cross-site scripting LearnPress – WordPress LMS Plugin is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4 NVD5.4
Apr 19, 2024	CVE-2024-3560 LearnPress – WordPress LMS Plugin: Cross-site scripting LearnPress – WordPress LMS Plugin is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4 NVD5.4
Apr 09, 2024	CVE-2024-1463 LearnPress – WordPress LMS Plugin: Cross-site scripting LearnPress – WordPress LMS Plugin is affected by cross-site scripting. Exploitation requires an authenticated WordPress account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE4.4 NVD4.8
Apr 09, 2024	CVE-2024-1289 LearnPress – WordPress LMS Plugin: Broken access control LearnPress – WordPress LMS Plugin is affected by broken access control. Exploitation requires an authenticated WordPress account. A successful request can reach data or an operation that should be restricted to another user or a more privileged role.	See mitigation notes	CVE6.5 NVD5.4
Apr 05, 2024	CVE-2024-2115 LearnPress – WordPress LMS Plugin: Cross-site request forgery LearnPress – WordPress LMS Plugin is affected by cross-site request forgery. The vulnerable path is reachable without authentication. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.	See mitigation notes	CVE8.8 NVDPending
Jan 16, 2024	CVE-2023-5558 LearnPress: Cross-site scripting LearnPress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.1 NVD6.1
Jan 11, 2024	CVE-2023-6634 LearnPress: Code execution LearnPress is affected by code execution. The vulnerable path is reachable without authentication. Successful exploitation can run attacker-controlled code in the WordPress hosting account.	See mitigation notes	CVE8.1 NVD9.8
Jan 11, 2024	CVE-2023-6567 LearnPress: SQL injection LearnPress is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE9.8 NVD7.5
Jan 11, 2024	CVE-2023-6223 LearnPress: Broken access control LearnPress is affected by broken access control. Exploitation requires an authenticated subscriber account. A successful request can reach data or an operation that should be restricted to another user or a more privileged role.	See mitigation notes	CVE4.3 NVD4.3
Jan 26, 2023	CVE-2022-47615 Learnpress: Filesystem traversal Learnpress is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.	See mitigation notes	CVE9.3 NVD9.8
Jan 26, 2023	CVE-2022-45820 Learnpress: SQL injection Learnpress is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE9.1 NVD8.8
Jan 26, 2023	CVE-2022-45808 Learnpress: SQL injection Learnpress is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE9.9 NVD9.8
Oct 31, 2022	CVE-2022-3360 LearnPress: Code execution LearnPress is affected by code execution. The vulnerable path is reachable without authentication. Successful exploitation can run attacker-controlled code in the WordPress hosting account.	See mitigation notes	CVE8.1 NVD8.1
Apr 11, 2022	CVE-2022-0271 LearnPress: Cross-site scripting LearnPress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVEPending NVD6.1
Feb 28, 2022	CVE-2022-0377 LearnPress: A security weakness LearnPress is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVEPending NVD4.3
Dec 13, 2021	CVE-2021-24951 LearnPress: SQL injection LearnPress is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVEPending NVD9.8
Oct 21, 2021	CVE-2021-39348 LearnPress: Cross-site scripting LearnPress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.5 NVD4.8
Oct 18, 2021	CVE-2021-24702 LearnPress: Cross-site scripting LearnPress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVEPending NVD4.8
Jul 30, 2021	CVE-2020-11511 Learnpress: A security weakness Learnpress is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVEPending NVD8.1
Apr 30, 2020	CVE-2020-6010 Learnpress: SQL injection Learnpress is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVEPending NVD8.8
Mar 16, 2020	CVE-2020-7916 Learnpress: A security weakness Learnpress is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVEPending NVD6.5
Jan 09, 2019	CVE-2018-16175 Learnpress: SQL injection Learnpress is affected by SQL injection. Exploitation requires an authenticated administrator account. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVEPending NVD7.2
Jan 09, 2019	CVE-2018-16174 Learnpress: An open redirect Learnpress is affected by an open redirect. Exposure depends on how the affected operation is made reachable by the site. A crafted link can redirect visitors from the trusted site to an attacker-controlled destination.	See mitigation notes	CVEPending NVD6.1
Jan 09, 2019	CVE-2018-16173 Learnpress: Cross-site scripting Learnpress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVEPending NVD6.1

Data attribution: This product uses the NVD API but is not endorsed or certified by the NVD.

Vulnerability data licensing

CVE. Copyright © 1999–2026, The MITRE Corporation. MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

CWE. Copyright © 2006–2026, The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy.

CVSS. CVSS is owned and managed by FIRST.Org, Inc. (FIRST) and used by permission.

Source-record text is CVE/CNA content delivered through the NVD API. Fused summaries and remediation guidance are independently authored and are not attributed to NVD.

All other copyrights and trademarks are the property of their respective owners.

Full data sources, terms, and disclaimers