Learnpress – Wordpress Lms Plugin
Approved changes feed: RSS · Atom
cpe:2.3:a:thimpress:learnpress_–_wordpress_lms_plugin:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Thimpress (3359de0e-d602-5f4a-8b30-12c81ab7a63c) |
|---|---|
| Product | Learnpress – Wordpress Lms Plugin (120fc6d1-084d-57da-97aa-64861af50d41) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-14387 |
vulnerable | 2026-06-08 07:06:34.383835 |
LearnPress – WordPress LMS Plugin <= 4.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via get_profile_social
MEDIUM (6.4)
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2025-12-15T15:30:54.785Z
Updated: 2026-04-08T17:32:40.040Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-13956 |
vulnerable | 2026-06-08 07:06:33.285972 |
LearnPress – WordPress LMS Plugin <= 4.3.1 - Missing Authorization to Unauthenticated Orders Statistics Exposure
MEDIUM (5.3)
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the statistic function in all versions up to, and including, 4.3.1. This makes it possible for unauthenticated attackers to view the plugin's orders statistics, including total revenue summaries and order status counts
Published: 2025-12-16T04:31:35.001Z
Updated: 2026-04-08T17:20:44.309Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-11372 |
vulnerable | 2026-06-08 07:02:28.670458 |
LearnPress – WordPress LMS Plugin <= 4.2.9.3 - Missing Authorization to Unauthenticated Database Table Manipulation
MEDIUM (6.5)
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to modification of data in all versions up to, and including, 4.2.9.2. This is due to missing capability checks on the Admin Tools REST endpoints which are registered with permission_callback set to __return_true. This makes it possible for unauthenticated attackers to perform destructive database operations including dropping indexes on any table (including WordPress core tables like wp_options), creating duplicate configuration entries, and degrading site performance via the /wp-json/lp/v1/admin/tools/create-indexs endpoint granted they can provide table names.
Published: 2025-10-18T06:42:48.790Z
Updated: 2026-04-08T17:25:20.007Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-11368 |
vulnerable | 2026-06-08 07:02:28.664570 |
LearnPress – WordPress LMS Plugin <= 4.2.9.4 - Missing Authorization to Unauthenticated Arbitrary Callback Execution to Information Exposure
MEDIUM (5.3)
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 4.2.9.4. This is due to missing capability checks in the REST endpoint /wp-json/lp/v1/load_content_via_ajax which allows arbitrary callback execution of admin-only template methods. This makes it possible for unauthenticated attackers to retrieve admin curriculum HTML, quiz questions with correct answers, course materials, and other sensitive educational content via the REST API endpoint granted they can supply valid numeric IDs.
Published: 2025-11-21T05:32:04.912Z
Updated: 2026-04-08T16:35:07.676Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-6099 |
vulnerable | 2026-06-08 06:58:17.773735 |
LearnPress – WordPress LMS Plugin <= 4.2.6.8.1 - Unauthenticated Bypass to User Registration
MEDIUM (5.3)
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthenticated bypass to user registration in versions up to, and including, 4.2.6.8.1. This is due to missing checks in the 'check_validate_fields' function in the checkout. This makes it possible for unauthenticated attackers to register as the default role on the site, even if registration is disabled.
Published: 2024-07-02T11:01:35.868Z
Updated: 2026-04-08T17:03:16.963Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-4277 |
vulnerable | 2026-06-08 06:50:17.419946 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-2115 |
vulnerable | 2026-06-08 06:33:30.370169 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-47615 |
vulnerable | 2026-06-08 05:50:40.823076 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-45820 |
vulnerable | 2026-06-08 05:50:37.275232 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-45808 |
vulnerable | 2026-06-08 05:50:37.242646 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.