Skip to content
Thimpress Learnpress vulnerabilities
-
thimpress learnpress
WordPress LearnPress plugin <= 4.4.12 - Broken Access Control vulnerability
CVE-2026-52713
5.4 Medium
-
thimpress learnpress – course review
LearnPress <= 4.2.2 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'review_title' Parameter
CVE-2026-118054
6.4 Medium
-
thimpress learnpress
WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability
CVE-2026-42690
5.4 Medium
-
thimpress learnpress
WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability
CVE-2026-115599
7.5 High
-
thimpress learnpress
WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability
CVE-2026-115598
5.3 Medium
-
thimpress learnpress
WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability
CVE-2026-115597
5.4 Medium
-
thimpress learnpress
LearnPress before 4.4.10 Missing Authorization via Legacy Editor AJAX Handlers
CVE-2026-113353
5.3 Medium
-
thimpress learnpress
WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability
CVE-2026-110363
5.4 Medium
-
thimpress learnpress – wordpress lms plugin for create and sell online courses
LearnPress <= 4.4.10 - Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via 'search-authors' AJAX Action
CVE-2026-107744
6.5 Medium
-
thimpress learnpress – wordpress lms plugin for create and sell online courses
LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter
CVE-2026-104736
Public exploit
9.8 Critical
-
thimpress learnpress – wordpress lms plugin for create and sell online courses
LearnPress <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' Parameters
CVE-2026-109208
7.2 High
-
thimpress learnpress
WordPress LearnPress plugin <= 4.4.9 - Cross Site Scripting (XSS) vulnerability
CVE-2026-104670
7.1 High
-
thimpress learnpress
LearnPress WordPress Plugin through 4.4.9.1 Stored XSS via Quiz Question Hint and Explanation
CVE-2026-105397
5.1 Medium
-
thimpress learnpress – wordpress lms plugin for create and sell online courses
LearnPress <= 4.4.7 - Reflected DOM-Based Cross-Site Scripting via 'orderby' Parameter
CVE-2026-92538
6.1 Medium
-
thimpress learnpress
WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability
CVE-2026-39717
4.3 Medium
-
thimpress learnpress
WordPress LearnPress plugin <= 4.4.9 - Insecure Direct Object References (IDOR) vulnerability
CVE-2026-104403
5.3 Medium
-
thimpress learnpress – wordpress lms plugin for create and sell online courses
LearnPress <= 4.4.8 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'item_id' Parameter
CVE-2026-93882
7.5 High
-
thimpress learnpress
LearnPress 4.4.3 - 4.4.6 - Unauthenticated Quiz Answer Disclosure via check-answer REST Endpoint
CVE-2026-86446
3.7 Low
-
thimpress learnpress
LearnPress < 4.4.7 - Unauthenticated Unpublished Course Disclosure via REST API
CVE-2026-86449
5.3 Medium
-
thimpress learnpress
LearnPress < 4.4.7 - Unauthenticated Order Data Disclosure via lp_download_order
CVE-2026-86448
3.7 Low
-
thimpress learnpress
LearnPress < 4.4.7 - Unauthenticated Student Enrollment Disclosure via load_content_via_ajax
CVE-2026-86447
5.3 Medium
-
thimpress learnpress
LearnPress < 4.4.7 - Unauthenticated Question Bank Disclosure via load_content_via_ajax
CVE-2026-86445
5.3 Medium
-
thimpress learnpress
LearnPress < 4.4.7 - Reflected XSS via 'skin' Parameter
CVE-2026-86444
7.1 High
-
thimpress learnpress – wordpress lms plugin for create and sell online courses
LearnPress <= 4.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'layout_custom_css'
CVE-2026-12230
6.4 Medium
-
thimpress learnpress
LearnPress WordPress Plugin < 4.4.6 Stored XSS via Quiz Question Answer Titles
CVE-2026-82024
5.1 Medium
-
thimpress learnpress
LearnPress WordPress Plugin < 4.4.6 Broken Object-Level Authorization via Quiz Answer Insert
CVE-2026-82023
5.3 Medium
-
thimpress learnpress – wordpress lms plugin for create and sell online courses
LearnPress <= 4.4.4 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
CVE-2026-77823
4.9 Medium
-
thimpress learnpress
LearnPress – Sepay Payment < 4.0.3 - Unauthenticated Order Status Disclosure
CVE-2026-78125
5.3 Medium
-
thimpress learnpress – wordpress lms plugin for create and sell online courses
LearnPress <= 4.4.4 - Missing Authorization to Authenticated (Editor+) Limited Option Update via 'field_name' Parameter
CVE-2026-75982
4.4 Medium
-
thimpress learnpress
LearnPress < 4.4.4 - Subscriber+ Sensitive Information Exposure via AI Assistant
CVE-2026-12976
6.5 Medium
-
thimpress learnpress
LearnPress < 4.4.4 - Instructor+ Server-Side Request Forgery via openai_apply_image_feature
CVE-2026-12971
2.2 Low
-
thimpress learnpress
LearnPress < 4.4.1 - Reflected XSS via c_search
CVE-2026-12970
7.1 High
-
thimpress learnpress – wordpress lms plugin for create and sell online courses
LearnPress <= 4.4.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure via /lp/v1/users/check-answer and /start-quiz REST Endpoints
CVE-2026-13765
7.5 High
-
thimpress learnpress – wordpress lms plugin for create and sell online courses
LearnPress <= 4.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class_wrapper_form' Shortcode Attribute
CVE-2026-12732
6.4 Medium
-
thimpress learnpress – wordpress lms plugin for create and sell online courses
LearnPress <= 4.3.9.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'userId' Parameter
CVE-2026-11988
6.5 Medium
-
thimpress learnpress
LearnPress < 4.3.7 - Unauthenticated Sensitive User Information Disclosure via REST API
CVE-2026-8383
5.3 Medium
-
thimpress learnpress – wordpress lms plugin for create and sell online courses
LearnPress <= 4.3.6 - Unauthenticated Sensitive Information Exposure via 'c_status' and 'return_type' Parameters
CVE-2026-8502
5.3 Medium
-
thimpress learnpress – backup & migration tool
LearnPress – Backup & Migration Tool <= 4.1.4 - Authenticated (Administrator+) PHP Object Injection via WXR XML File Upload
CVE-2026-7566
6.6 Medium
-
thimpress learnpress – backup & migration tool
LearnPress <= 4.1.4 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'import-user-file' Parameter
CVE-2026-7565
4.9 Medium
-
thimpress learnpress
WordPress LearnPress plugin <= 4.3.6 - Reflected Cross Site Scripting (XSS) vulnerability
CVE-2026-48865
7.1 High
-
thimpress learnpress – wordpress lms plugin for create and sell online courses
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.5 - Authenticated (Subscriber+) Payment Bypass to Free Course Enrollment via 'quantity' Parameter
CVE-2026-7648
4.3 Medium
-
thimpress learnpress – wordpress lms plugin for create and sell online courses
LearnPress <= 4.3.2.8 - Missing Authorization to Unauthenticated Arbitrary Quiz Answer Deletion
CVE-2026-4365
9.1 Critical
-
thimpress learnpress – wordpress lms plugin for create and sell online courses
LearnPress <= 4.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'skin' Shortcode Attribute
CVE-2026-4333
6.4 Medium
-
thimpress learnpress – sepay payment
WordPress LearnPress – Sepay Payment plugin <= 4.0.0 - Broken Authentication vulnerability
CVE-2026-25002
7.5 High
-
thimpress learnpress – wordpress lms plugin for create and sell online courses
LearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Answer Deletion
CVE-2026-3225
4.3 Medium
-
thimpress learnpress – wordpress lms plugin for create and sell online courses
LearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Notification Triggering
CVE-2026-3226
4.3 Medium
-
thimpress learnpress – backup & migration tool
LearnPress Export Import <= 4.1.0 - Missing Authentication to Unauthenticated Migrated Course Deletion
CVE-2026-1787
4.8 Medium
-
thimpress learnpress – course review
WordPress LearnPress – Course Review plugin <= 4.1.9 - Cross Site Scripting (XSS) vulnerability
CVE-2026-24361
6.5 Medium
-
thimpress learnpress – wordpress lms plugin for create and sell online courses
LearnPress – WordPress LMS Plugin <= 4.3.2.4 - Missing Authorization to Unauthenticated Sensitive User Information Disclosure via REST API
CVE-2025-14798
5.3 Medium
-
thimpress learnpress – wordpress lms plugin for create and sell online courses
LearnPress – WordPress LMS Plugin <= 4.3.2.2 - Insecure Direct Object Reference to Authenticated (Instructor+) Teacher Material Deletion
CVE-2025-14802
5.4 Medium
- Show olderLoading…