Skip to contentThimpress Learnpress – Wordpress Lms Plugin For Create And Sell Online Courses vulnerabilities
- thimpress learnpress – wordpress lms plugin for create and sell online coursesLearnPress <= 4.4.10 - Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via 'search-authors' AJAX ActionCVE-2026-1077446.5 Medium
- thimpress learnpress – wordpress lms plugin for create and sell online coursesLearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' ParameterCVE-2026-104736Public exploit9.8 Critical
- thimpress learnpress – wordpress lms plugin for create and sell online coursesLearnPress <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' ParametersCVE-2026-1092087.2 High
- thimpress learnpress – wordpress lms plugin for create and sell online coursesLearnPress <= 4.4.7 - Reflected DOM-Based Cross-Site Scripting via 'orderby' ParameterCVE-2026-925386.1 Medium
- thimpress learnpress – wordpress lms plugin for create and sell online coursesLearnPress <= 4.4.8 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'item_id' ParameterCVE-2026-938827.5 High
- thimpress learnpress – wordpress lms plugin for create and sell online coursesLearnPress <= 4.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'layout_custom_css'CVE-2026-122306.4 Medium
- thimpress learnpress – wordpress lms plugin for create and sell online coursesLearnPress <= 4.4.4 - Authenticated (Administrator+) SQL Injection via 'orderby' ParameterCVE-2026-778234.9 Medium
- thimpress learnpress – wordpress lms plugin for create and sell online coursesLearnPress <= 4.4.4 - Missing Authorization to Authenticated (Editor+) Limited Option Update via 'field_name' ParameterCVE-2026-759824.4 Medium
- thimpress learnpress – wordpress lms plugin for create and sell online coursesLearnPress <= 4.4.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure via /lp/v1/users/check-answer and /start-quiz REST EndpointsCVE-2026-137657.5 High
- thimpress learnpress – wordpress lms plugin for create and sell online coursesLearnPress <= 4.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class_wrapper_form' Shortcode AttributeCVE-2026-127326.4 Medium
- thimpress learnpress – wordpress lms plugin for create and sell online coursesLearnPress <= 4.3.9.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'userId' ParameterCVE-2026-119886.5 Medium
- thimpress learnpress – wordpress lms plugin for create and sell online coursesLearnPress <= 4.3.6 - Unauthenticated Sensitive Information Exposure via 'c_status' and 'return_type' ParametersCVE-2026-85025.3 Medium
- thimpress learnpress – wordpress lms plugin for create and sell online coursesLearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.5 - Authenticated (Subscriber+) Payment Bypass to Free Course Enrollment via 'quantity' ParameterCVE-2026-76484.3 Medium
- thimpress learnpress – wordpress lms plugin for create and sell online coursesLearnPress <= 4.3.2.8 - Missing Authorization to Unauthenticated Arbitrary Quiz Answer DeletionCVE-2026-43659.1 Critical
- thimpress learnpress – wordpress lms plugin for create and sell online coursesLearnPress <= 4.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'skin' Shortcode AttributeCVE-2026-43336.4 Medium
- thimpress learnpress – wordpress lms plugin for create and sell online coursesLearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Answer DeletionCVE-2026-32254.3 Medium
- thimpress learnpress – wordpress lms plugin for create and sell online coursesLearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Notification TriggeringCVE-2026-32264.3 Medium
- thimpress learnpress – wordpress lms plugin for create and sell online coursesLearnPress – WordPress LMS Plugin <= 4.3.2.4 - Missing Authorization to Unauthenticated Sensitive User Information Disclosure via REST APICVE-2025-147985.3 Medium
- thimpress learnpress – wordpress lms plugin for create and sell online coursesLearnPress – WordPress LMS Plugin <= 4.3.2.2 - Insecure Direct Object Reference to Authenticated (Instructor+) Teacher Material DeletionCVE-2025-148025.4 Medium
- thimpress learnpress – wordpress lms plugin for create and sell online coursesLearnPress – WordPress LMS Plugin <= 4.3.2 - Missing Authentication to Unauthenticated Course ModificationCVE-2025-139645.3 Medium
- thimpress learnpress – wordpress lms plugin for create and sell online coursesLearnPress – WordPress LMS Plugin <= 4.3.1 - Missing Authorization to Unauthenticated Orders Statistics ExposureCVE-2025-139565.3 Medium
- thimpress learnpress – wordpress lms plugin for create and sell online coursesLearnPress – WordPress LMS Plugin <= 4.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via get_profile_socialCVE-2025-143876.4 Medium
- thimpress learnpress – wordpress lms plugin for create and sell online coursesLearnPress – WordPress LMS Plugin <= 4.2.9.4 - Missing Authorization to Unauthenticated Arbitrary Callback Execution to Information ExposureCVE-2025-113685.3 Medium
- thimpress learnpress – wordpress lms plugin for create and sell online coursesLearnPress – WordPress LMS Plugin <= 4.2.9.3 - Missing Authorization to Unauthenticated Database Table ManipulationCVE-2025-113726.5 Medium
- thimpress learnpress, learnpress – wordpress lms plugin for create and sell online courses +1 moreLearnPress – WordPress LMS Plugin <= 4.2.7.5 - Authenticated (LP Instructor+) Stored Cross-Site Scripting via Lesson NameCVE-2024-135996.4 Medium
- thimpress learnpress, learnpress – wordpress lms plugin for create and sell online courses +1 moreLearnPress – WordPress LMS Plugin <= 4.2.7.3 - Course Material Sensitive Information Exposure via REST APICVE-2024-118685.3 Medium
- thimpress learnpress, learnpress – wordpress lms plugin for create and sell online courses +1 moreLearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_fields'CVE-2024-8529Public exploitEPSS 12.1%10.0 Critical
- thimpress learnpress, learnpress – wordpress lms plugin for create and sell online courses +1 moreLearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_only_fields'CVE-2024-8522Public exploitEPSS 62.9%10.0 Critical
- thimpress learnpress, learnpress – wordpress lms plugin for create and sell online courses +1 moreLearnPress – WordPress LMS Plugin <= 4.2.6.9.3 - Authenticated (Contributor+) SQL Injection via order ParameterCVE-2024-75488.8 High
- thimpress learnpress, learnpress – wordpress lms plugin for create and sell online courses +1 moreLearnPress <= 4.2.6.8.2 - Authenticated (Contributor+) Local File InclusionCVE-2024-65898.8 High
- thimpress learnpress, learnpress – wordpress lms plugin for create and sell online courses +1 moreLearnPress – WordPress LMS Plugin <= 4.2.6.8.1 - Unauthenticated Bypass to User RegistrationCVE-2024-60995.3 Medium
- thimpress learnpress, learnpress – wordpress lms plugin for create and sell online courses +1 moreLearnPress – WordPress LMS Plugin <= 4.2.6.8.1 - Missing Authorization to Unauthenticated User Registration BypassCVE-2024-60885.3 Medium
- thimpress learnpress, learnpress – wordpress lms plugin for create and sell online courses +1 moreLearnPress – WordPress LMS Plugin <= 4.2.6.8 - Basic Information Disclosure via JSON APICVE-2024-54835.3 Medium
- thimpress learnpress, learnpress – wordpress lms plugin for create and sell online courses +1 moreLearnPress – WordPress LMS Plugin <= 4.2.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id ParameterCVE-2024-49716.4 Medium
- thimpress learnpress, learnpress – wordpress lms plugin for create and sell online courses +1 moreLearnPress – WordPress LMS Plugin <= 4.2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via layout_html ParameterCVE-2024-42776.4 Medium
- thimpress learnpress, learnpress – wordpress lms plugin for create and sell online courses +1 moreLearnPress – WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Bypass to User RegistrationCVE-2024-44445.3 Medium
- thimpress learnpress, learnpress – wordpress lms plugin for create and sell online courses +1 moreLearnPress – WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Time-Based SQL InjectionCVE-2024-4434EPSS 36.9%9.8 Critical
- thimpress learnpress, learnpress – wordpress lms plugin for create and sell online courses +1 moreLearnPress – WordPress LMS Plugin <= 4.2.6.5 - Authenticated (Instructor+) Arbitrary File UploadCVE-2024-43978.8 High
- thimpress learnpress, learnpress – wordpress lms plugin for create and sell online courses +1 moreLearnPress – WordPress LMS Plugin <= 4.2.6.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingCVE-2024-35606.4 Medium
- thimpress learnpress, learnpress – wordpress lms plugin for create and sell online courses +1 moreLearnPress <= 4.2.6.3 - Authenticated(LP Instructor+) Stored Cross-Site ScriptingCVE-2024-14634.4 Medium
- thimpress learnpress, learnpress – wordpress lms plugin for create and sell online courses +1 moreLearnPress <= 4.2.6.3 - Insecure Direct Object ReferenceCVE-2024-12896.5 Medium
- thimpress learnpress, learnpress – wordpress lms plugin for create and sell online courses +1 moreLearnPress – WordPress LMS Plugin <= 4.0.0 - Cross-Site Request Forgery to Privilege EscalationCVE-2024-21158.8 High
- thimpress learnpress, learnpress – wordpress lms plugin for create and sell online courses +1 moreLearnPress <= 4.2.5.7 - Unauthenticated SQL Injection via order_byCVE-2023-6567Public exploitEPSS 51.4%9.8 Critical
- thimpress learnpress, learnpress – wordpress lms plugin for create and sell online courses +1 moreLearnPress <= 4.2.5.7 - Command InjectionCVE-2023-6634Public exploit8.1 High
- thimpress learnpress, learnpress – wordpress lms plugin for create and sell online courses +1 moreLearnPress <= 4.2.5.7 - Insecure Direct Object Reference to Information DisclosureCVE-2023-62234.3 Medium