EN ES
Start free
Menu

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: known security problems

101 known security problems reported for this WordPress plugin, with the affected versions, the fix and what to do.

Updated

In short

There are 101 known security problems on this page. 99 of them have a fixed version. Updating to version 4.4.12 or newer covers every fixed problem listed here.

Based on public reports. Check the plugin’s changelog. Watchfox AI may be wrong.

Get an email when your site is affected: install Watchfox AI (free)

This week

Someone could do things on your site they should not be allowed to (up to and including 4.4.11)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.4.11
Fixed in
4.4.12
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.4.12 or newer.
Official ID
CVE-2026-115598
Report title
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.11 - Missing Authorization
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 4.4.11) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.4.11
Fixed in
4.4.12
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.4.12 or newer.
Official ID
CVE-2026-115597
Report title
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.11 - Missing Authorization
First reported
Sources
This week

Someone could use it to harm your site (before 4.4.10)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 4.4.10
Fixed in
No fixed version yet
What to do
There is no fixed version yet. If your site uses it, think about turning it off or replacing it until a fix comes out.
Official ID
CVE-2026-113353
Report title
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses < 4.4.10 - Authenticated (Custom+) Insecure Direct Object Reference
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 4.4.10)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.4.10
Fixed in
4.4.11
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.4.11 or newer.
Official ID
CVE-2026-42690
Report title
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.10 - Missing Authorization
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 4.4.10) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.4.10
Fixed in
4.4.11
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.4.11 or newer.
Official ID
CVE-2026-110363
Report title
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.10 - Missing Authorization
First reported
Sources
This week

A stranger could in some setups, take over your site (up to and including 4.4.10)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.4.10
Fixed in
4.4.11
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.4.11 or newer.
Official ID
CVE-2026-104736
Report title
LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter
First reported
Sources
This week

Anyone with an account on your site, even a basic one could do things on your site they should not be allowed to (up to and including 4.4.10)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.4.10
Fixed in
4.4.11
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.4.11 or newer.
Official ID
CVE-2026-107744
Report title
LearnPress <= 4.4.10 - Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via 'search-authors' AJAX Action
First reported
Sources
This week

A stranger could plant harmful code that runs for your visitors or admins (up to and including 4.4.10)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.4.10
Fixed in
4.4.11
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.4.11 or newer.
Official ID
CVE-2026-109208
Report title
LearnPress <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' Parameters
First reported
Sources
This week

A stranger could plant harmful code that runs for your visitors or admins (up to and including 4.4.9)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.4.9
Fixed in
4.4.9.1
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.4.9.1 or newer.
Official ID
CVE-2026-104670
Report title
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.9 - Unauthenticated Stored Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 4.4.9.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.4.9.1
Fixed in
4.4.10
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.4.10 or newer.
Official ID
CVE-2026-105397
Report title
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.9.1 - Authenticated (Instructor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 4.4.9.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.4.9.1
Fixed in
No fixed version yet
What to do
There is no fixed version yet. If your site uses it, think about turning it off or replacing it until a fix comes out.
Official ID
CVE-2026-39717
Report title
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.9.1 - Missing Authorization
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 4.4.7)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.4.7
Fixed in
4.4.8
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.4.8 or newer.
Official ID
CVE-2026-92538
Report title
LearnPress <= 4.4.7 - Reflected DOM-Based Cross-Site Scripting via 'orderby' Parameter
First reported
Sources
This week

A stranger could use it to harm your site (up to and including 4.4.9)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.4.9
Fixed in
4.4.9.1
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.4.9.1 or newer.
Official ID
CVE-2026-104403
Report title
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.9 - Unauthenticated Insecure Direct Object Reference
First reported
Sources
This week

A stranger could use it to harm your site (up to and including 4.4.8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.4.8
Fixed in
4.4.9
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.4.9 or newer.
Official ID
CVE-2026-93882
Report title
LearnPress <= 4.4.8 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'item_id' Parameter
First reported
Sources
This week

A stranger could use it to harm your site (from 4.4.3 up to and including 4.4.6)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 4.4.3 up to and including 4.4.6
Fixed in
4.4.7
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.4.7 or newer.
Official ID
CVE-2026-86446
Report title
LearnPress 4.4.3 - 4.4.6 - Unauthenticated Information Exposure
First reported
Sources
This week

A stranger could use it to harm your site (up to and including 4.4.6)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.4.6
Fixed in
4.4.7
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.4.7 or newer.
Official ID
CVE-2026-86448
Report title
LearnPress <= 4.4.6 - Unauthenticated Information Exposure
First reported
Sources
This week

A stranger could use it to harm your site (up to and including 4.4.6) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.4.6
Fixed in
4.4.7
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.4.7 or newer.
Official ID
CVE-2026-86445
Report title
LearnPress <= 4.4.6 - Unauthenticated Information Exposure
First reported
Sources
This week

A stranger could use it to harm your site (up to and including 4.4.6) (3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.4.6
Fixed in
4.4.7
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.4.7 or newer.
Official ID
CVE-2026-86447
Report title
LearnPress <= 4.4.6 - Unauthenticated Information Exposure
First reported
Sources
This week

A stranger could use it to harm your site (up to and including 4.4.6) (4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.4.6
Fixed in
4.4.7
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.4.7 or newer.
Official ID
CVE-2026-86449
Report title
LearnPress <= 4.4.6 - Unauthenticated Information Exposure
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 4.4.6)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.4.6
Fixed in
4.4.7
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.4.7 or newer.
Official ID
CVE-2026-86444
Report title
LearnPress <= 4.4.6 - Reflected Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 4.3.9.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.3.9.1
Fixed in
4.4.0
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.4.0 or newer.
Official ID
CVE-2026-12230
Report title
LearnPress <= 4.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'layout_custom_css'
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 4.4.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.4.5
Fixed in
4.4.6
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.4.6 or newer.
Official ID
CVE-2026-82023
Report title
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.5 - Missing Authorization
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 4.4.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.4.5
Fixed in
4.4.6
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.4.6 or newer.
Official ID
CVE-2026-82024
Report title
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.5 - Authenticated (Instructor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone who already has an admin account could read or change the data in your site’s database

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.4.4
Fixed in
4.4.5
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.4.5 or newer.
Official ID
CVE-2026-77823
Report title
LearnPress <= 4.4.4 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
First reported
Sources
This week

Someone with an editor account on your site could do things on your site they should not be allowed to

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.4.4
Fixed in
4.4.5
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.4.5 or newer.
Official ID
CVE-2026-75982
Report title
LearnPress <= 4.4.4 - Missing Authorization to Authenticated (Editor+) Limited Option Update via 'field_name' Parameter
First reported
Sources
This week

Anyone with an account on your site, even a basic one could use it to harm your site (before 4.4.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 4.4.4
Fixed in
4.4.4
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.4.4 or newer.
Official ID
CVE-2026-12976
Report title
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses < 4.4.4 - Authenticated (Subscriber+) Information Exposure
First reported
Sources
This week

Someone could make your server visit other addresses on their behalf

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.4.3
Fixed in
4.4.4
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.4.4 or newer.
Official ID
CVE-2026-12971
Report title
LearnPress <= 4.4.3 - Authenticated (Instructor+) Server-Side Request Forgery
First reported
Sources
This week

A stranger could see private information they should not see (up to and including 4.4.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.4.1
Fixed in
4.4.2
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.4.2 or newer.
Official ID
CVE-2026-13765
Report title
LearnPress <= 4.4.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure via /lp/v1/users/check-answer and /start-quiz REST Endpoints
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 4.4.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.4.0
Fixed in
4.4.1
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.4.1 or newer.
Official ID
CVE-2026-12732
Report title
LearnPress <= 4.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class_wrapper_form' Shortcode Attribute
First reported
Sources
This week

Anyone with an account on your site, even a basic one could use it to harm your site (up to and including 4.3.9.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.3.9.1
Fixed in
4.4.0
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.4.0 or newer.
Official ID
CVE-2026-11988
Report title
LearnPress <= 4.3.9.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'userId' Parameter
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 4.4.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.4.0
Fixed in
4.4.1
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.4.1 or newer.
Official ID
CVE-2026-12970
Report title
LearnPress <= 4.4.0 - Reflected Cross-Site Scripting
First reported
Sources
This week

A stranger could do things on your site they should not be allowed to (up to and including 4.3.6)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.3.6
Fixed in
4.3.7
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.3.7 or newer.
Official ID
CVE-2026-8383
Report title
LearnPress <= 4.3.6 - Missing Authorization to Unauthenticated Sensitive User Information Disclosure
First reported
Sources
This week

A stranger could see private information they should not see (up to and including 4.3.6)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.3.6
Fixed in
4.3.7
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.3.7 or newer.
Official ID
CVE-2026-8502
Report title
LearnPress <= 4.3.6 - Unauthenticated Sensitive Information Exposure via 'c_status' and 'return_type' Parameters
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 4.3.6)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.3.6
Fixed in
4.3.7
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.3.7 or newer.
Official ID
CVE-2026-48865
Report title
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.6 - Reflected Cross-Site Scripting
First reported
Sources
This week

Anyone with an account on your site, even a basic one could use it to harm your site (up to and including 4.3.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.3.5
Fixed in
4.3.6
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.3.6 or newer.
Official ID
CVE-2026-7648
Report title
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.5 - Authenticated (Subscriber+) Payment Bypass to Free Course Enrollment via 'quantity' Parameter
First reported
Sources
This week

A stranger could do things on your site they should not be allowed to (up to and including 4.3.2.8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.3.2.8
Fixed in
4.3.3
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.3.3 or newer.
Official ID
CVE-2026-4365
Report title
LearnPress <= 4.3.2.8 - Missing Authorization to Unauthenticated Arbitrary Quiz Answer Deletion
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 4.3.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.3.3
Fixed in
4.3.4
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.3.4 or newer.
Official ID
CVE-2026-4333
Report title
LearnPress <= 4.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'skin' Shortcode Attribute
First reported
Sources
This week

Anyone with an account on your site, even a basic one could do things on your site they should not be allowed to (up to and including 4.3.2.8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.3.2.8
Fixed in
4.3.3
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.3.3 or newer.
Official ID
CVE-2026-3225
Report title
LearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Answer Deletion
First reported
Sources
This week

Anyone with an account on your site, even a basic one could do things on your site they should not be allowed to (up to and including 4.3.2.8) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.3.2.8
Fixed in
4.3.3
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.3.3 or newer.
Official ID
CVE-2026-3226
Report title
LearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Notification Triggering
First reported
Sources
This week

A stranger could do things on your site they should not be allowed to (up to and including 4.3.2.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.3.2.4
Fixed in
4.3.2.5
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.3.2.5 or newer.
Official ID
CVE-2025-14798
Report title
LearnPress – WordPress LMS Plugin <= 4.3.2.4 - Missing Authorization to Unauthenticated Sensitive User Information Disclosure via REST API
First reported
Sources
This week

Someone could use it to harm your site (up to and including 4.3.2.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.3.2.1
Fixed in
4.3.2.2
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.3.2.2 or newer.
Official ID
CVE-2025-14802
Report title
LearnPress – WordPress LMS Plugin <= 4.3.2.2 - Insecure Direct Object Reference to Authenticated (Instructor+) Teacher Material Deletion
First reported
Sources
This week

A stranger could use it to harm your site (up to and including 4.3.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.3.2
Fixed in
4.3.2.1
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.3.2.1 or newer.
Official ID
CVE-2025-13964
Report title
LearnPress – WordPress LMS Plugin <= 4.3.2 - Missing Authentication to Unauthenticated Course Modification
First reported
Sources
This week

A stranger could do things on your site they should not be allowed to (up to and including 4.3.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.3.1
Fixed in
4.3.2
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.3.2 or newer.
Official ID
CVE-2025-13956
Report title
LearnPress – WordPress LMS Plugin <= 4.3.1 - Missing Authorization to Unauthenticated Orders Statistics Exposure
First reported
Sources
This week

Anyone with an account on your site, even a basic one could plant harmful code that runs for your visitors or admins

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.3.1
Fixed in
4.3.2
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.3.2 or newer.
Official ID
CVE-2025-14387
Report title
LearnPress – WordPress LMS Plugin <= 4.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via get_profile_social
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 4.2.9.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.2.9.4
Fixed in
4.3.0
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.3.0 or newer.
Official ID
CVE-2025-66054
Report title
LearnPress <= 4.2.9.4 - Missing Authorization
First reported
Sources
This week

A stranger could do things on your site they should not be allowed to (up to and including 4.2.9.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.2.9.4
Fixed in
4.3.0
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.3.0 or newer.
Official ID
CVE-2025-11368
Report title
LearnPress – WordPress LMS Plugin <= 4.2.9.4 - Missing Authorization to Unauthenticated Arbitrary Callback Execution to Information Exposure
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 4.2.9.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.2.9.4
Fixed in
4.3.0
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.3.0 or newer.
Official ID
CVE-2025-67536
Report title
LearnPress <= 4.2.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

A stranger could do things on your site they should not be allowed to (up to and including 4.2.9.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.2.9.3
Fixed in
4.2.9.4
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.2.9.4 or newer.
Official ID
CVE-2025-11372
Report title
LearnPress – WordPress LMS Plugin <= 4.2.9.3 - Missing Authorization to Unauthenticated Database Table Manipulation
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 4.2.7.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.2.7.5
Fixed in
4.2.7.6
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.2.7.6 or newer.
Official ID
CVE-2025-22739
Report title
LearnPress <= 4.2.7.5 - Missing Authorization
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 4.2.7.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.2.7.5
Fixed in
4.2.7.5.1
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.2.7.5.1 or newer.
Official ID
CVE-2024-13127
Report title
LearnPress – WordPress LMS Plugin <= 4.2.7.5 - Authenticated (Admin+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 4.2.7.5) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.2.7.5
Fixed in
4.2.7.5.1
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.2.7.5.1 or newer.
Official ID
CVE-2024-13128
Report title
LearnPress – WordPress LMS Plugin <= 4.2.7.5 - Authenticated (Admin+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 4.2.7.5) (3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.2.7.5
Fixed in
4.2.7.5.1
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.2.7.5.1 or newer.
Official ID
CVE-2024-13599
Report title
LearnPress – WordPress LMS Plugin <= 4.2.7.5 - Authenticated (LP Instructor+) Stored Cross-Site Scripting via Lesson Name
First reported
Sources
This week

Anyone with an account on your site, even a basic one could send your visitors from your site to a harmful site

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.2.7.1
Fixed in
4.2.7.2
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.2.7.2 or newer.
Official ID
CVE-2025-24740
Report title
LearnPress <= 4.2.7.1 - Authenticated (Subscriber+) Open Redirect
First reported
Sources
This week

Someone could see private information they should not see

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.2.7.3
Fixed in
4.2.7.4
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.2.7.4 or newer.
Official ID
CVE-2024-11868
Report title
LearnPress – WordPress LMS Plugin <= 4.2.7.3 - Course Material Sensitive Information Exposure via REST API
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 4.2.7.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.2.7.1
Fixed in
4.2.7.2
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.2.7.2 or newer.
Official ID
CVE-2024-10010
Report title
LearnPress <= 4.2.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 4.2.7.1) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.2.7.1
Fixed in
4.2.7.2
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.2.7.2 or newer.
Official ID
CVE-2024-9881
Report title
LearnPress <= 4.2.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting
First reported
Sources
This week

A stranger could read or change the data in your site’s database (up to and including 4.2.7)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.2.7
Fixed in
4.2.7.1
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.2.7.1 or newer.
Official ID
CVE-2024-8529
Report title
LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_fields'
First reported
Sources
This week

A stranger could read or change the data in your site’s database (up to and including 4.2.7) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.2.7
Fixed in
4.2.7.1
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.2.7.1 or newer.
Official ID
CVE-2024-8522
Report title
LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_only_fields'
First reported
Sources
This week

Someone with a contributor account on your site could read or change the data in your site’s database

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.2.6.9.3
Fixed in
4.2.6.9.4
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.2.6.9.4 or newer.
Official ID
CVE-2024-7548
Report title
LearnPress – WordPress LMS Plugin <= 4.2.6.9.3 - Authenticated (Contributor+) SQL Injection via order Parameter
First reported
Sources
This week

Someone could trick a logged-in admin into changing settings without knowing

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.2.6.8.2
Fixed in
4.2.6.9
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.2.6.9 or newer.
Official ID
CVE-2024-39641
Report title
LearnPress <= 4.2.6.8.2 - Cross-Site Request Forgery
First reported
Sources
This week

Anyone with an account on your site, even a basic one could use it to harm your site (up to and including 4.2.6.8.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.2.6.8.2
Fixed in
4.2.6.9
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.2.6.9 or newer.
Official ID
CVE-2024-39642
Report title
LearnPress <= 4.2.6.8.2 - Authenticated (Subscriber+) Insecure Direct Object Reference
First reported
Sources
This week

Someone with a contributor account on your site could read or delete private files on your server

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.2.6.8.2
Fixed in
4.2.6.9
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.2.6.9 or newer.
Official ID
CVE-2024-6589
Report title
LearnPress <= 4.2.6.8.2 - Authenticated (Contributor+) Local File Inclusion
First reported
Sources
This week

A stranger could do things on your site they should not be allowed to (up to and including 4.2.6.8.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.2.6.8.1
Fixed in
4.2.6.8.2
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.2.6.8.2 or newer.
Official ID
CVE-2024-6088
Report title
LearnPress – WordPress LMS Plugin <= 4.2.6.8.1 - Missing Authorization to Unauthenticated User Registration Bypass
First reported
Sources
This week

A stranger could use it to harm your site (up to and including 4.2.6.8.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.2.6.8.1
Fixed in
4.2.6.8.2
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.2.6.8.2 or newer.
Official ID
CVE-2024-6099
Report title
LearnPress – WordPress LMS Plugin <= 4.2.6.8.1 - Unauthenticated Bypass to User Registration
First reported
Sources
This week

Someone could use it to harm your site (up to and including 4.2.6.8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.2.6.8
Fixed in
4.2.6.8.1
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.2.6.8.1 or newer.
Official ID
CVE-2024-5483
Report title
LearnPress – WordPress LMS Plugin <= 4.2.6.8 - Basic Information Disclosure via JSON API
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 4.2.6.6)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.2.6.6
Fixed in
4.2.6.7
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.2.6.7 or newer.
Official ID
CVE-2024-4971
Report title
LearnPress – WordPress LMS Plugin <= 4.2.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 4.2.6.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.2.6.5
Fixed in
4.2.6.6
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.2.6.6 or newer.
Official ID
CVE-2024-4277
Report title
LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via layout_html Parameter
First reported
Sources
This week

A stranger could read or change the data in your site’s database (up to and including 4.2.6.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.2.6.5
Fixed in
4.2.6.6
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.2.6.6 or newer.
Official ID
CVE-2024-4434
Report title
LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Time-Based SQL Injection
First reported
Sources
This week

A stranger could use it to harm your site (up to and including 4.2.6.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.2.6.5
Fixed in
4.2.6.6
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.2.6.6 or newer.
Official ID
CVE-2024-4444
Report title
LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Bypass to User Registration
First reported
Sources
This week

Someone could run their own code on your site and take it over

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.2.6.5
Fixed in
4.2.6.6
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.2.6.6 or newer.
Official ID
CVE-2024-4397
Report title
LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Authenticated (Instructor+) Arbitrary File Upload
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 4.2.6.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.2.6.4
Fixed in
4.2.6.5
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.2.6.5 or newer.
Official ID
CVE-2024-3560
Report title
LearnPress – WordPress LMS Plugin <= 4.2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone could use it to harm your site (up to and including 4.2.6.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.2.6.3
Fixed in
4.2.6.4
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.2.6.4 or newer.
Official ID
CVE-2024-1289
Report title
LearnPress <= 4.2.6.3 - Insecure Direct Object Reference
First reported
Sources
This week

Someone could take over your site as an admin (up to and including 4.0.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.0.0
Fixed in
4.0.1
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.0.1 or newer.
Official ID
CVE-2024-2115
Report title
LearnPress – WordPress LMS Plugin <= 4.0.0 - Cross-Site Request Forgery to Privilege Escalation
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 4.2.6.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.2.6.3
Fixed in
4.2.6.4
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.2.6.4 or newer.
Official ID
CVE-2024-1463
Report title
LearnPress <= 4.2.6.3 - Authenticated(LP Instructor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone could use it to harm your site (up to and including 4.2.5.7)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.2.5.7
Fixed in
4.2.5.8
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.2.5.8 or newer.
Official ID
CVE-2023-6634
Report title
LearnPress <= 4.2.5.7 - Command Injection
First reported
Sources
This week

Someone could use it to harm your site (up to and including 4.2.5.7) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.2.5.7
Fixed in
4.2.5.8
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.2.5.8 or newer.
Official ID
CVE-2023-6223
Report title
LearnPress <= 4.2.5.7 - Insecure Direct Object Reference to Information Disclosure
First reported
Sources
This week

A stranger could read or change the data in your site’s database (up to and including 4.2.5.7)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.2.5.7
Fixed in
4.2.5.8
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.2.5.8 or newer.
Official ID
CVE-2023-6567
Report title
LearnPress <= 4.2.5.7 - Unauthenticated SQL Injection via order_by
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 4.2.5.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 4.2.5.4
Fixed in
4.2.5.4
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.2.5.4 or newer.
Official ID
CVE-2023-5558
Report title
LearnPress <= 4.2.5.3 - Reflected Cross-Site Scripting via add_internal_scripts_to_head
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (before 4.2.3.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 4.2.3.1
Fixed in
4.2.3.1
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.2.3.1 or newer.
Report title
LearnPress <= 4.2.3 - Missing Authorization
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 4.2.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.2.3
Fixed in
4.2.3.1
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.2.3.1 or newer.
Official ID
CVE-2023-36516
Report title
LearnPress <= 4.2.3 - Missing Authorization
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 4.2.3) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.2.3
Fixed in
4.2.3.1
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.2.3.1 or newer.
Official ID
CVE-2023-36515
Report title
LearnPress <= 4.2.3 - Missing Authorization to Information Exposure
First reported
Sources
This week

A stranger could read or change the data in your site’s database (up to and including 4.1.7.3.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.1.7.3.2
Fixed in
4.2.0
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.2.0 or newer.
Official ID
CVE-2022-45808
Report title
LearnPress <= 4.1.7.3.2 - Unauthenticated SQL Injection
First reported
Sources
This week

A stranger could read or delete private files on your server

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.1.7.3.2
Fixed in
4.2.0
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.2.0 or newer.
Official ID
CVE-2022-47615
Report title
LearnPress <= 4.1.7.3.2 - Unauthenticated Local File Inclusion
First reported
Sources
This week

Anyone with an account on your site, even a basic one could read or change the data in your site’s database

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.1.7.3.2
Fixed in
4.2.0
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.2.0 or newer.
Official ID
CVE-2022-45820
Report title
LearnPress <= 4.1.7.3.2 - Authenticated (Subscriber+) SQL Injection
First reported
Sources
This week

A stranger could in some setups, take over your site (up to and including 4.1.7.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.1.7.1
Fixed in
4.1.7.2
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.1.7.2 or newer.
Official ID
CVE-2022-3360
Report title
LearnPress <= 4.1.7.1 - Unauthenticated PHP Object Injection
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 4.1.6.7)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.1.6.7
Fixed in
4.1.6.8
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.1.6.8 or newer.
Report title
LearnPress – WordPress LMS Plugin <= 4.1.6.7 - Reflected Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 4.1.6.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.1.6.5
Fixed in
4.1.6.6
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.1.6.6 or newer.
Report title
LearnPress – WordPress LMS Plugin <= 4.1.6.5 - Reflected Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 4.1.6)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 4.1.6
Fixed in
4.1.6
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.1.6 or newer.
Official ID
CVE-2022-0271
Report title
LearnPress <= 4.1.5 - Reflected Cross-Site Scripting
First reported
Sources
This week

Someone could use it to harm your site (up to and including 4.1.4.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.1.4.1
Fixed in
4.1.5
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.1.5 or newer.
Official ID
CVE-2022-0377
Report title
LearnPress <= 4.1.4.1 - Arbitrary Image Renaming
First reported
Sources
This week

Someone could read or change the data in your site’s database (before 4.1.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 4.1.4
Fixed in
4.1.4
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.1.4 or newer.
Official ID
CVE-2021-24951
Report title
LearnPress <= 4.1.3 - Authenticated SQL Injection
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 4.1.3.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.1.3.1
Fixed in
4.1.3.2
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.1.3.2 or newer.
Official ID
CVE-2021-39348
Report title
LearnPress <= 4.1.3.1 - Stored Cross-Site Scripting via $custom_profile
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 4.1.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.1.3
Fixed in
4.1.3.1
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 4.1.3.1 or newer.
Official ID
CVE-2021-24702
Report title
LearnPress <= 4.1.3 - Authenticated Stored Cross-Site Scripting
First reported
Sources
This week

Someone could read or change the data in your site’s database (up to and including 3.2.6.7)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.6.7
Fixed in
3.2.6.8
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 3.2.6.8 or newer.
Official ID
CVE-2020-6010
Report title
LearnPress <= 3.2.6.7 - SQL Injection
First reported
Sources
This week

Someone could read or change the data in your site’s database (up to and including 3.2.7.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.7.2
Fixed in
3.2.7.3
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 3.2.7.3 or newer.
Report title
LearnPress – WordPress LMS Plugin <= 3.2.7.2 - SQL Injection
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 3.2.7.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.2.7.3
Fixed in
3.2.7.3
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 3.2.7.3 or newer.
Report title
LearnPress <= 3.2.7.2 - Reflected Cross-Site Scripting
First reported
Sources
This week

Someone could take over your site as an admin (up to and including 3.2.6.8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.6.8
Fixed in
3.2.6.9
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 3.2.6.9 or newer.
Official ID
CVE-2020-11511
Report title
LearnPress <= 3.2.6.8 - Privilege Escalation via accept-to-be-teacher action parameter
First reported
Sources
This week

Someone could use it to harm your site (up to and including 3.2.6.8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.6.8
Fixed in
3.2.6.9
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 3.2.6.9 or newer.
Official ID
CVE-2020-11510
Report title
LearnPress <= 3.2.6.8 - Authenticated Page Creation and Status Modification
First reported
Sources
This week

Someone could take over your site as an admin (up to and including 3.2.6.6)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.2.6.6
Fixed in
3.2.6.8
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 3.2.6.8 or newer.
Official ID
CVE-2020-7916
Report title
LearnPress <= 3.2.6.6 - Privilege Escalation
First reported
Sources
This week

Someone could read or change the data in your site’s database (up to and including 3.0.12)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.0.12
Fixed in
3.1.0
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 3.1.0 or newer.
Official ID
CVE-2018-16175
Report title
LearnPress <= 3.0.12 - Authenticated SQL Injection
First reported
Sources
This week

Someone could send your visitors from your site to a harmful site

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.0.12
Fixed in
3.1.0
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 3.1.0 or newer.
Official ID
CVE-2018-16174
Report title
LearnPress <= 3.0.12 - Open Redirect
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.0.12)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.0.12
Fixed in
3.1.0
What to do
If your site has an affected version, update LearnPress – WordPress LMS Plugin for Create and Sell Online Courses to version 3.1.0 or newer.
Official ID
CVE-2018-16173
Report title
LearnPress <= 3.0.12 - Cross-Site Scripting
First reported
Sources

Where this comes from

We collect these reports from public security sources and rewrite them in plain words. Each problem shows its sources and the date we first saw it. This page never says whether your own site is affected: only a check of your site’s versions can tell.

All plugins and themes

Get an email when your site is affected.

Install Watchfox AI once. It checks your plugins and themes against this list every day, for free.

Install Watchfox AI (free)