Learndash - vulnerabilities (CVEs)

13 CVEs in 3 products, 0 in the last 30 days, newest from 2026-09-06.

Products

• Learndash - 11 CVEs
• Learndash Lms - 2 CVEs
• Memberdash - 1 CVEs

Newest CVEs of Learndash

• CVE-2026-16310 - CVSS 9.8 (critical), 2026-09-06: The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.8.5 via the 'id' parameter due…
• CVE-2024-56939 - CVSS 5.4 (medium), 2025-02-12: LearnDash v6.7.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the ld-comment-body class.
• CVE-2024-56938 - CVSS 5.4 (medium), 2025-02-12: LearnDash v6.7.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the materials-content class.
• CVE-2024-56940 - CVSS 7.5 (high), 2025-02-12: An issue in the profile image upload function of LearnDash v6.7.1 allows attackers to cause a Denial of Service (DoS) via excessive file uploads.
• CVE-2025-24662 - CVSS 5.3 (medium), 2025-01-27: Missing Authorization vulnerability in LearnDash LearnDash LMS allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects…
• CVE-2024-1209 - CVSS 5.3 (medium), 2024-02-05: The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.1 via direct file access due…
• CVE-2024-1210 - CVSS 5.3 (medium), 2024-02-05: The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.1 via API. This makes it…
• CVE-2024-1208 - CVSS 5.3 (medium), 2024-02-05: The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.2 via API. This makes it…
• CVE-2023-28777 - CVSS 8.8 (high), 2023-10-31: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LearnDash LearnDash LMS allows SQL Injection.This issue…
• CVE-2023-3105 - CVSS 8.8 (high), 2023-07-12: The LearnDash LMS plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 4.6.0. This is due to the plugin…
• CVE-2018-25019 - CVSS 7.5 (high), 2021-11-01: The LearnDash LMS WordPress plugin before 2.5.4 does not have any authorisation and validation of the file to be uploaded in the…
• CVE-2020-6009 - CVSS 9.8 (critical), 2020-04-01: LearnDash Wordpress plugin version below 3.1.6 is vulnerable to Unauthenticated SQL Injection.
• CVE-2020-7108 - CVSS 5.4 (medium), 2020-01-16: The LearnDash LMS plugin before 3.1.2 for WordPress allows XSS via the ld-profile search field.