Unknown Learnpress vulnerabilities

• thimpress learnpress LearnPress 4.4.3 - 4.4.6 - Unauthenticated Quiz Answer Disclosure via check-answer REST Endpoint CVE-2026-86446 3.7 LowSeptember 17, 2026
• thimpress learnpress LearnPress < 4.4.7 - Unauthenticated Unpublished Course Disclosure via REST API CVE-2026-86449 5.3 MediumSeptember 16, 2026
• thimpress learnpress LearnPress < 4.4.7 - Unauthenticated Order Data Disclosure via lp_download_order CVE-2026-86448 3.7 LowSeptember 16, 2026
• thimpress learnpress LearnPress < 4.4.7 - Unauthenticated Student Enrollment Disclosure via load_content_via_ajax CVE-2026-86447 5.3 MediumSeptember 16, 2026
• thimpress learnpress LearnPress < 4.4.7 - Unauthenticated Question Bank Disclosure via load_content_via_ajax CVE-2026-86445 5.3 MediumSeptember 16, 2026
• thimpress learnpress LearnPress < 4.4.7 - Reflected XSS via 'skin' Parameter CVE-2026-86444 7.1 HighSeptember 16, 2026
• thimpress learnpress LearnPress – Sepay Payment < 4.0.3 - Unauthenticated Order Status Disclosure CVE-2026-78125 5.3 MediumAugust 27, 2026
• thimpress learnpress LearnPress < 4.4.4 - Subscriber+ Sensitive Information Exposure via AI Assistant CVE-2026-12976 6.5 MediumAugust 12, 2026
• thimpress learnpress LearnPress < 4.4.4 - Instructor+ Server-Side Request Forgery via openai_apply_image_feature CVE-2026-12971 2.2 LowAugust 10, 2026
• thimpress learnpress LearnPress < 4.4.1 - Reflected XSS via c_search CVE-2026-12970 7.1 HighJuly 20, 2026
• thimpress learnpress LearnPress < 4.3.7 - Unauthenticated Sensitive User Information Disclosure via REST API CVE-2026-8383 5.3 MediumJune 17, 2026
• thimpress learnpress LearnPress – WordPress LMS Plugin < 4.2.7.5.1 - Admin+ Stored XSS CVE-2024-13128 4.8 MediumMay 15, 2025
• thimpress learnpress LearnPress – WordPress LMS Plugin < 4.2.7.5.1 - Admin+ Stored XSS CVE-2024-13127 4.8 MediumMay 15, 2025
• thimpress learnpress LearnPress < 4.2.7.2 - Admin+ Stored XSS CVE-2024-9881 4.8 MediumDecember 12, 2024
• thimpress learnpress LearnPress < 4.2.7.2 - Admin+ Stored XSS CVE-2024-10010 4.8 MediumDecember 12, 2024
• thimpress learnpress LearnPress < 4.2.5.5 - Reflected Cross-Site Scripting CVE-2023-5558 6.1 MediumJanuary 16, 2024
• thimpress learnpress, learnpress – wordpress lms plugin +1 more LearnPress < 4.1.7.2 - Unauthenticated PHP Object Injection via REST API CVE-2022-3360 8.1 HighOctober 31, 2022
• thimpress learnpress, learnpress – wordpress lms plugin +1 more LearnPress < 4.1.6 - Reflected Cross-Site Scripting CVE-2022-0271 6.1 MediumApril 11, 2022
• thimpress learnpress LearnPress < 4.1.5 - Arbitrary Image Renaming CVE-2022-0377 Public exploit 4.3 MediumFebruary 28, 2022
• thimpress learnpress, learnpress – wordpress lms plugin +1 more LearnPress < 4.1.4 - Admin+ SQL Injection CVE-2021-24951 9.8 CriticalDecember 13, 2021
• thimpress learnpress, learnpress – wordpress lms plugin +1 more LearnPress < 4.1.3.1 - Multiple Admin+ Stored Cross-Site Scripting CVE-2021-24702 4.8 MediumOctober 18, 2021