Learnpress (Unknown) - vulnerabilities (CVEs)
17 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2026-09-17. Vendor: Unknown.
CVEs of Learnpress
- CVE-2026-86446 - CVSS 3.7 (low), 2026-09-17: The LearnPress WordPress plugin before 4.4.7 does not restrict the correctness flags it returns when a quiz answer is checked, allowing unauthenticated…
- CVE-2026-86445 - CVSS 5.3 (medium), 2026-09-16: The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative template handlers, allowing unauthenticated…
- CVE-2026-86449 - CVSS 5.3 (medium), 2026-09-16: The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities before applying a user supplied post status filter in one of its REST…
- CVE-2026-86448 - CVSS 3.7 (low), 2026-09-16: The LearnPress WordPress plugin before 4.4.7 does not perform any authentication, capability or nonce check before serving a previously generated order export…
- CVE-2026-86447 - CVSS 5.3 (medium), 2026-09-16: The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative course tools, allowing unauthenticated…
- CVE-2026-86444 - CVSS 7.1 (high), 2026-09-16: The LearnPress WordPress plugin before 4.4.7 does not escape a user supplied value before using it in an HTML attribute on a public page, allowing…
- CVE-2026-78125 - CVSS 5.3 (medium), 2026-08-27: The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in all versions up to, and including,…
- CVE-2026-12976 - CVSS 6.5 (medium), 2026-08-12: The LearnPress WordPress plugin before 4.4.4 does not verify that a user is enrolled in a course before processing AI-assistant requests against that course's…
- CVE-2026-12971 - CVSS 2.2 (low), 2026-08-10: The LearnPress WordPress plugin before 4.4.4 does not validate a user-supplied URL before the server fetches it, allowing users with the instructor role to…
- CVE-2026-12970 - CVSS 7.1 (high), 2026-07-20: The LearnPress WordPress plugin before 4.4.1 does not escape a search parameter before reflecting it into an HTML attribute, leading to Reflected Cross-Site…
- CVE-2026-8383 - CVSS 5.3 (medium), 2026-06-17: The LearnPress WordPress plugin before 4.3.7 does not gate the `edit` context on one of its REST endpoint behind the `edit_users` capability, allowing…
- CVE-2024-13128 - CVSS 4.8 (medium), 2025-05-15: The LearnPress WordPress plugin before 4.2.7.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to…
- CVE-2024-13127 - CVSS 4.8 (medium), 2025-05-15: The LearnPress WordPress plugin before 4.2.7.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to…
- CVE-2024-9881 - CVSS 4.8 (medium), 2024-12-12: The LearnPress WordPress plugin before 4.2.7.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to…
- CVE-2024-10010 - CVSS 4.8 (medium), 2024-12-12: The LearnPress WordPress plugin before 4.2.7.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to…
- CVE-2023-5558 - CVSS 6.1 (medium), 2024-01-16: The LearnPress WordPress plugin before 4.2.5.5 does not sanitise and escape user input before outputting it back in the page, leading to a Reflected…
- CVE-2022-0377 - CVSS 4.3 (medium), 2022-02-28: Users of the LearnPress WordPress plugin before 4.1.5 can upload an image as a profile avatar after the registration. After this process the user crops and…
