thimpress learnpress vulnerabilities, newest first, page 2
Filter
By year: all 2026 2025 2024 2023 2022 2021
- 8.8CVE-2022-45820EPSS 1.0%
SQL Injection (SQLi) vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions.
- 9.8CVE-2022-45808ExploitEPSS 4.3%
SQL Injection vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions.
- 8.1CVE-2022-3360EPSS 2.6%
The LearnPress WordPress plugin before 4.1.7.2 unserialises user input in a REST API endpoint available to unauthenticated users, which could lead to PHP Object Injection when a suitable gadget is present, leadint to remote code execution …
- 6.1CVE-2022-0271ExploitEPSS 1.9%
The LearnPress WordPress plugin before 4.1.6 does not sanitise and escape the lp-dismiss-notice before outputting it back via the lp_background_single_email AJAX action, leading to a Reflected Cross-Site Scripting
- 4.3CVE-2022-0377ExploitEPSS 3.2%
Users of the LearnPress WordPress plugin before 4.1.5 can upload an image as a profile avatar after the registration. After this process the user crops and saves the image. Then a "POST" request that contains user supplied name of the ima…
- 9.8CVE-2021-24951EPSS 1.6%
The LearnPress WordPress plugin before 4.1.4 does not sanitise, validate and escape the id parameter before using it in SQL statements when duplicating course/lesson/quiz/question, leading to SQL Injections issues
- 4.8CVE-2021-39348EPSS 5.2%
The LearnPress WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping on the $custom_profile parameter found in the ~/inc/admin/views/backend-user-profile.php file which allowed attackers with administra…
- 4.8CVE-2021-24702EPSS 0.7%
The LearnPress WordPress plugin before 4.1.3.1 does not properly sanitize or escape various inputs within course settings, which could allow high privilege users to perform Cross-Site Scripting attacks when the unfiltred_html capability is…
- 8.1CVE-2020-11511EPSS 3.2%
The LearnPress plugin before 3.2.6.9 for WordPress allows remote attackers to escalate the privileges of any user to LP Instructor via the accept-to-be-teacher action parameter.
- 8.8CVE-2020-6010ExploitEPSS 49%
LearnPress Wordpress plugin version prior and including 3.2.6.7 is vulnerable to SQL Injection
- 6.5CVE-2020-7916EPSS 1.1%
be_teacher in class-lp-admin-ajax.php in the LearnPress plugin 3.2.6.5 and earlier for WordPress allows any registered user to assign itself the teacher role via the wp-admin/admin-ajax.php?action=learnpress_be_teacher URI without any addi…
- 7.2CVE-2018-16175EPSS 1.3%
SQL injection vulnerability in the LearnPress prior to version 3.1.0 allows attacker with administrator rights to execute arbitrary SQL commands via unspecified vectors.
- 6.1CVE-2018-16174EPSS 1.0%
Open redirect vulnerability in LearnPress prior to version 3.1.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
- 6.1CVE-2018-16173EPSS 1.0%
Cross-site scripting vulnerability in LearnPress prior to version 3.1.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.