VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses security & vulnerabilities

learnpress— active installsLast vulnerability Nov 7, 2026

Unpatched vulnerability in the latest version

At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.

Watch plugin
103Known vulnerabilities
  • Critical10
  • High17
  • Medium76
  • Low0
Vulnerabilities per year
2018: 3 vulnerabilities3182020: 5 vulnerabilities5202021: 4 vulnerabilities4212022: 6 vulnerabilities6222023: 6 vulnerabilities6232024: 24 vulnerabilities24242025: 11 vulnerabilities11252026: 44 vulnerabilities4426

All LearnPress – WordPress LMS Plugin for Create and Sell Online Courses vulnerabilities

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses vulnerabilities
SeverityVulnerabilityCVEPublished
Medium4.3Missing Authorization
≤4.4.12Update to 4.4.13
CVE-2026-52713
Medium5.3Missing Authorization
≤4.4.11Update to 4.4.12
CVE-2026-115599
Medium5.3Missing Authorization
≤4.4.11Update to 4.4.12
CVE-2026-115598
Medium4.3Missing Authorization
≤4.4.11Update to 4.4.12
CVE-2026-115597
Medium4.3Missing Authorization
≤4.4.10Update to 4.4.11
CVE-2026-42690
Medium4.3Authenticated (Custom+) Insecure Direct Object Reference
<4.4.10No patch available
CVE-2026-113353
Medium4.3Missing Authorization
≤4.4.10Update to 4.4.11
CVE-2026-110363
Critical9.8Unauthenticated PHP Object Injection via 'checkout-email' Parameter
≤4.4.10Update to 4.4.11
CVE-2026-104736
Medium6.5Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via 'search-authors' AJAX Action
≤4.4.10Update to 4.4.11
CVE-2026-107744
High7.2Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' Parameters
≤4.4.10Update to 4.4.11
CVE-2026-109208
High7.2Unauthenticated Stored Cross-Site Scripting
≤4.4.9Update to 4.4.9.1
CVE-2026-104670
Medium6.4Authenticated (Instructor+) Stored Cross-Site Scripting
≤4.4.9.1Update to 4.4.10
CVE-2026-105397
Medium4.3Missing Authorization
≤4.4.10Update to 4.4.11
CVE-2026-39717
Medium6.1Reflected DOM-Based Cross-Site Scripting via 'orderby' Parameter
≤4.4.7Update to 4.4.8
CVE-2026-92538
Medium5.3Unauthenticated Insecure Direct Object Reference
≤4.4.9Update to 4.4.9.1
CVE-2026-104403
High7.5Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'item_id' Parameter
≤4.4.8Update to 4.4.9
CVE-2026-93882
Medium5.34.4.6 - Unauthenticated Information Exposure
4.4.3 – 4.4.6Update to 4.4.7
CVE-2026-86446
Medium5.3Unauthenticated Information Exposure
≤4.4.6Update to 4.4.7
CVE-2026-86448
Medium6.1Reflected Cross-Site Scripting
≤4.4.6Update to 4.4.7
CVE-2026-86444
Medium5.3Unauthenticated Information Exposure
≤4.4.6Update to 4.4.7
CVE-2026-86447
Medium5.3Unauthenticated Information Exposure
≤4.4.6Update to 4.4.7
CVE-2026-86445
Medium5.3Unauthenticated Information Exposure
≤4.4.6Update to 4.4.7
CVE-2026-86449
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'layout_custom_css'
≤4.3.9.1Update to 4.4.0
CVE-2026-12230
Medium4.3Missing Authorization
≤4.4.5Update to 4.4.6
CVE-2026-82023
Medium6.4Authenticated (Instructor+) Stored Cross-Site Scripting
≤4.4.5Update to 4.4.6
CVE-2026-82024
Medium4.9Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
≤4.4.4Update to 4.4.5
CVE-2026-77823
Medium4.4Missing Authorization to Authenticated (Editor+) Limited Option Update via 'field_name' Parameter
≤4.4.4Update to 4.4.5
CVE-2026-75982
Medium4.3Authenticated (Subscriber+) Information Exposure
<4.4.4Update to 4.4.4
CVE-2026-12976
Medium6.4Authenticated (Instructor+) Server-Side Request Forgery
≤4.4.3Update to 4.4.4
CVE-2026-12971
High7.5Missing Authorization to Unauthenticated Sensitive Information Exposure via /lp/v1/users/check-answer and /start-quiz REST Endpoints
≤4.4.1Update to 4.4.2
CVE-2026-13765
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'class_wrapper_form' Shortcode Attribute
≤4.4.0Update to 4.4.1
CVE-2026-12732
Medium6.5Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'userId' Parameter
≤4.3.9.1Update to 4.4.0
CVE-2026-11988
Medium6.1Reflected Cross-Site Scripting
≤4.4.0Update to 4.4.1
CVE-2026-12970
Medium5.3Missing Authorization to Unauthenticated Sensitive User Information Disclosure
≤4.3.6Update to 4.3.7
CVE-2026-8383
Medium5.3Unauthenticated Sensitive Information Exposure via 'c_status' and 'return_type' Parameters
≤4.3.6Update to 4.3.7
CVE-2026-8502
Medium6.1Reflected Cross-Site Scripting
≤4.3.6Update to 4.3.7
CVE-2026-48865
Medium4.3Authenticated (Subscriber+) Payment Bypass to Free Course Enrollment via 'quantity' Parameter
≤4.3.5Update to 4.3.6
CVE-2026-7648
Critical9.1Missing Authorization to Unauthenticated Arbitrary Quiz Answer Deletion
≤4.3.2.8Update to 4.3.3
CVE-2026-4365
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'skin' Shortcode Attribute
≤4.3.3Update to 4.3.4
CVE-2026-4333
Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Answer Deletion
≤4.3.2.8Update to 4.3.3
CVE-2026-3225
Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Notification Triggering
≤4.3.2.8Update to 4.3.3
CVE-2026-3226
Medium5.3Missing Authorization to Unauthenticated Sensitive User Information Disclosure via REST API
≤4.3.2.4Update to 4.3.2.5
CVE-2025-14798
Medium5.4Insecure Direct Object Reference to Authenticated (Instructor+) Teacher Material Deletion
≤4.3.2.1Update to 4.3.2.2
CVE-2025-14802
Medium5.3Missing Authentication to Unauthenticated Course Modification
≤4.3.2Update to 4.3.2.1
CVE-2025-13964
Medium5.3Missing Authorization to Unauthenticated Orders Statistics Exposure
≤4.3.1Update to 4.3.2
CVE-2025-13956
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via get_profile_social
≤4.3.1Update to 4.3.2
CVE-2025-14387
Medium5.3Missing Authorization
≤4.2.9.4Update to 4.3.0
CVE-2025-66054
Medium5.3Missing Authorization to Unauthenticated Arbitrary Callback Execution to Information Exposure
≤4.2.9.4Update to 4.3.0
CVE-2025-11368
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤4.2.9.4Update to 4.3.0
CVE-2025-67536
Medium6.5Missing Authorization to Unauthenticated Database Table Manipulation
≤4.2.9.3Update to 4.2.9.4
CVE-2025-11372
Medium5.3Missing Authorization
≤4.2.7.5Update to 4.2.7.6
CVE-2025-22739
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤4.2.7.5Update to 4.2.7.5.1
CVE-2024-13128
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤4.2.7.5Update to 4.2.7.5.1
CVE-2024-13127
Medium6.4Authenticated (LP Instructor+) Stored Cross-Site Scripting via Lesson Name
≤4.2.7.5Update to 4.2.7.5.1
CVE-2024-13599
Medium5.4Authenticated (Subscriber+) Open Redirect
≤4.2.7.1Update to 4.2.7.2
CVE-2025-24740
Medium5.3Course Material Sensitive Information Exposure via REST API
≤4.2.7.3Update to 4.2.7.4
CVE-2024-11868
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤4.2.7.1Update to 4.2.7.2
CVE-2024-9881
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤4.2.7.1Update to 4.2.7.2
CVE-2024-10010
Critical10.0Unauthenticated SQL Injection via 'c_fields'
≤4.2.7Update to 4.2.7.1
CVE-2024-8529
Critical10.0Unauthenticated SQL Injection via 'c_only_fields'
≤4.2.7Update to 4.2.7.1
CVE-2024-8522
High8.8Authenticated (Contributor+) SQL Injection via order Parameter
≤4.2.6.9.3Update to 4.2.6.9.4
CVE-2024-7548
Medium5.4Authenticated (Subscriber+) Insecure Direct Object Reference
≤4.2.6.8.2Update to 4.2.6.9
CVE-2024-39642
Medium4.3Cross-Site Request Forgery
≤4.2.6.8.2Update to 4.2.6.9
CVE-2024-39641
High8.8Authenticated (Contributor+) Local File Inclusion
≤4.2.6.8.2Update to 4.2.6.9
CVE-2024-6589
Medium5.3Unauthenticated Bypass to User Registration
≤4.2.6.8.1Update to 4.2.6.8.2
CVE-2024-6099
Medium5.3Missing Authorization to Unauthenticated User Registration Bypass
≤4.2.6.8.1Update to 4.2.6.8.2
CVE-2024-6088
Medium5.3Basic Information Disclosure via JSON API
≤4.2.6.8Update to 4.2.6.8.1
CVE-2024-5483
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
≤4.2.6.6Update to 4.2.6.7
CVE-2024-4971
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via layout_html Parameter
≤4.2.6.5Update to 4.2.6.6
CVE-2024-4277
Critical9.8Unauthenticated Time-Based SQL Injection
≤4.2.6.5Update to 4.2.6.6
CVE-2024-4434
High8.8Authenticated (Instructor+) Arbitrary File Upload
≤4.2.6.5Update to 4.2.6.6
CVE-2024-4397
Medium5.3Unauthenticated Bypass to User Registration
≤4.2.6.5Update to 4.2.6.6
CVE-2024-4444
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤4.2.6.4Update to 4.2.6.5
CVE-2024-3560
Medium4.4Authenticated(LP Instructor+) Stored Cross-Site Scripting
≤4.2.6.3Update to 4.2.6.4
CVE-2024-1463
High8.8Cross-Site Request Forgery to Privilege Escalation
≤4.0.0Update to 4.0.1
CVE-2024-2115
Medium6.5Insecure Direct Object Reference
≤4.2.6.3Update to 4.2.6.4
CVE-2024-1289
High8.1Command Injection
≤4.2.5.7Update to 4.2.5.8
CVE-2023-6634
Critical9.8Unauthenticated SQL Injection via order_by
≤4.2.5.7Update to 4.2.5.8
CVE-2023-6567
Medium4.3Insecure Direct Object Reference to Information Disclosure
≤4.2.5.7Update to 4.2.5.8
CVE-2023-6223
Medium6.1Reflected Cross-Site Scripting via add_internal_scripts_to_head
<4.2.5.4Update to 4.2.5.4
CVE-2023-5558
Medium5.4Missing Authorization
<4.2.3.1Update to 4.2.3.1
—
Medium5.4Missing Authorization
≤4.2.3Update to 4.2.3.1
CVE-2023-36516
High7.3Missing Authorization to Information Exposure
≤4.2.3Update to 4.2.3.1
CVE-2023-36515
Critical9.8Unauthenticated Local File Inclusion
≤4.1.7.3.2Update to 4.2.0
CVE-2022-47615
Critical9.8Unauthenticated SQL Injection
≤4.1.7.3.2Update to 4.2.0
CVE-2022-45808
High8.8Authenticated (Subscriber+) SQL Injection
≤4.1.7.3.2Update to 4.2.0
CVE-2022-45820
Critical9.8Unauthenticated PHP Object Injection
≤4.1.7.1Update to 4.1.7.2
CVE-2022-3360
Medium6.1Reflected Cross-Site Scripting
≤4.1.6.7Update to 4.1.6.8
—
Medium6.1Reflected Cross-Site Scripting
≤4.1.6.5Update to 4.1.6.6
—
Medium6.1Reflected Cross-Site Scripting
<4.1.6Update to 4.1.6
CVE-2022-0271
Medium4.3Arbitrary Image Renaming
≤4.1.4.1Update to 4.1.5
CVE-2022-0377
Critical9.8Authenticated SQL Injection
<4.1.4Update to 4.1.4
CVE-2021-24951
Medium5.5Stored Cross-Site Scripting via $custom_profile
≤4.1.3.1Update to 4.1.3.2
CVE-2021-39348
Medium4.8Authenticated Stored Cross-Site Scripting
≤4.1.3Update to 4.1.3.1
CVE-2021-24702
High8.8SQL Injection
≤3.2.6.7Update to 3.2.6.8
CVE-2020-6010
High8.8SQL Injection
≤3.2.7.2Update to 3.2.7.3
—
Medium6.1Reflected Cross-Site Scripting
<3.2.7.3Update to 3.2.7.3
—
High8.1Privilege Escalation via accept-to-be-teacher action parameter
≤3.2.6.8Update to 3.2.6.9
CVE-2020-11511
High7.1Authenticated Page Creation and Status Modification
≤3.2.6.8Update to 3.2.6.9
CVE-2020-11510
High7.1Privilege Escalation
≤3.2.6.6Update to 3.2.6.8
CVE-2020-7916
Medium6.1Cross-Site Scripting
≤3.0.12Update to 3.1.0
CVE-2018-16173
Medium6.1Open Redirect
≤3.0.12Update to 3.1.0
CVE-2018-16174
High7.2Authenticated SQL Injection
≤3.0.12Update to 3.1.0
CVE-2018-16175

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: common questions

Does LearnPress – WordPress LMS Plugin for Create and Sell Online Courses have known vulnerabilities?

Yes. VulnCrest Radar lists 103 known vulnerabilities in LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: 10 critical, 17 high, 76 medium. At least one is not fixed in the latest version.

How do I check which version of LearnPress – WordPress LMS Plugin for Create and Sell Online Courses I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent LearnPress – WordPress LMS Plugin for Create and Sell Online Courses vulnerability?

CVE-2026-52713, published Nov 7, 2026: LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.12 - Missing Authorization. Severity: Medium (CVSS 4.3).

Is any LearnPress – WordPress LMS Plugin for Create and Sell Online Courses vulnerability listed in CISA KEV?

No. None of the known LearnPress – WordPress LMS Plugin for Create and Sell Online Courses vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?