Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-10-06
Learnpress - Security Vulnerability (CVE-2026-104670)
Unauthenticated Cross Site Scripting (XSS) in LearnPress
PLUGIN
Learnpress
CVE-2026-104670
Risk Score
Threat Entry
Updated 2026-10-07
Learnpress - Security Vulnerability (CVE-2026-105397)
LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role can submit unsanitized payloads through the update_question AJAX handler that execute in the session of every student taking the quiz.
PLUGIN
Learnpress
CVE-2026-105397
Risk Score
Threat Entry
Updated 2026-10-06
Learnpress - Security Vulnerability (CVE-2026-92538)
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'orderby' parameter in all versions up to, and including, 4.4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
Learnpress
CVE-2026-92538
Risk Score
Threat Entry
Updated 2026-10-09
Learnpress - Security Vulnerability (CVE-2026-39717)
Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.10.
PLUGIN
Learnpress
CVE-2026-39717
Risk Score
Threat Entry
Updated 2026-10-03
Learnpress - Security Vulnerability (CVE-2026-104403)
Authorization Bypass Through User-Controlled Key vulnerability in ThimPress LearnPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects LearnPress: from n/a through 4.4.9.
PLUGIN
Learnpress
CVE-2026-104403
Risk Score
Threat Entry
Updated 2026-10-03
Learnpress - Security Vulnerability (CVE-2026-93882)
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.4.8 via the CourseMaterialTemplate::render_material_items() callback exposed on the public lp-ajax-handle (load_content_via_ajax) endpoint. The endpoint is explicitly listed in the AbstractAjax no-nonce allowlist and performs no capability check, and the render_material_items() handler decides authorization against one attacker-supplied identifier (course_id) while fetching the returned material rows via a second, independently attacker-supplied identifier (item_id) with no check that the lesson belongs to the authorized course.…
PLUGIN
Learnpress
CVE-2026-93882
Risk Score
Threat Entry
Updated 2026-09-18
LearnPress - Security Vulnerability (CVE-2026-86446)
The LearnPress WordPress plugin before 4.4.7 does not restrict the correctness flags it returns when a quiz answer is checked, allowing unauthenticated attackers to obtain the correct answer to every option of a question, along with the instructor's explanation, on courses configured to be taken without enrolling.
PLUGIN
LearnPress
CVE-2026-86446
Risk Score
Threat Entry
Updated 2026-09-17
LearnPress - Security Vulnerability (CVE-2026-86444)
The LearnPress WordPress plugin before 4.4.7 does not escape a user supplied value before using it in an HTML attribute on a public page, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of anyone who opens a crafted link, including a logged in administrator. Only sites running a classic, non-block are affected.
PLUGIN
LearnPress
CVE-2026-86444
Risk Score
Threat Entry
Updated 2026-09-17
LearnPress - Security Vulnerability (CVE-2026-86449)
The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities before applying a user supplied post status filter in one of its REST routes, allowing unauthenticated attackers to list courses that are not published, including draft, pending, private, scheduled and trashed ones.
PLUGIN
LearnPress
CVE-2026-86449
Risk Score
Threat Entry
Updated 2026-09-17
LearnPress - Security Vulnerability (CVE-2026-86447)
The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative course tools, allowing unauthenticated attackers to list every enrolled student's display name and user identifier against the course they are enrolled on, and to recover their email addresses through the same handler's search filter.
PLUGIN
LearnPress
CVE-2026-86447
Risk Score
Threat Entry
Updated 2026-09-17
LearnPress - Security Vulnerability (CVE-2026-86445)
The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative template handlers, allowing unauthenticated attackers to retrieve the text, identifier and type of every published quiz question on the site, along with a keyword search over them, which is content the LearnPress WordPress plugin before 4.4.7 otherwise keeps non-public.
PLUGIN
LearnPress
CVE-2026-86445
Risk Score
Threat Entry
Updated 2026-09-17
LearnPress - Security Vulnerability (CVE-2026-86448)
The LearnPress WordPress plugin before 4.4.7 does not perform any authentication, capability or nonce check before serving a previously generated order export file, allowing unauthenticated attackers who can determine its identifier to download customer names, purchases, amounts and guest email addresses.
PLUGIN
LearnPress
CVE-2026-86448
Risk Score
Threat Entry
Updated 2026-09-09
Learnpress - Cross-Site Scripting (XSS) (CVE-2026-12230)
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'layout_custom_css' parameter in all versions up to, and including, 4.3.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Learnpress
CVE-2026-12230
Risk Score
Threat Entry
Updated 2026-09-08
Learnpress - Security Vulnerability (CVE-2026-82023)
LearnPress WordPress Plugin before 4.4.6 contains a broken object-level authorization vulnerability that allows authenticated attackers with the Instructor role to add answers to quiz questions owned by other instructors by exploiting a missing ownership check on the question answer insert path. Attackers can supply arbitrary question identifiers during answer insertion, bypassing instructor-boundary restrictions to persistently modify quiz content across courses they do not own.
PLUGIN
Learnpress
CVE-2026-82023
Risk Score
Threat Entry
Updated 2026-09-08
Learnpress - Cross-Site Scripting (XSS) (CVE-2026-82024)
LearnPress WordPress Plugin before 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers with the Instructor role to inject persistent malicious payloads by submitting unsanitized input into quiz question answer title fields. Attackers can store arbitrary JavaScript through the answer title parameter, which is rendered through an unescaped HTML sink to execute in the browsers of any user who views the affected quiz question, including students, other instructors, and administrators.
PLUGIN
Learnpress
CVE-2026-82024
Risk Score
Threat Entry
Updated 2026-09-01
Learnpress - SQL Injection (CVE-2026-77823)
The LearnPress plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the export_order_csv AJAX action in versions up to, and including, 4.4.4. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the LP_Order::handle_params_query_list_orders() and DataBase::execute() functions — only the literal values 'date' and 'title' are normalized, while any other attacker-controlled string is assigned directly to the filter's order_by property and concatenated into the ORDER BY clause without $wpdb->prepare() or an identifier whitelist. This…
PLUGIN
Learnpress
CVE-2026-77823
Risk Score
Threat Entry
Updated 2026-08-28
LearnPress - Security Vulnerability (CVE-2026-78125)
The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in all versions up to, and including, 4.0.2, allowing unauthenticated attackers to disclose the payment status of arbitrary orders by enumerating order identifiers.
PLUGIN
LearnPress
CVE-2026-78125
Risk Score
Threat Entry
Updated 2026-10-12
Learnpress - Security Vulnerability (CVE-2026-75982)
The LearnPress plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in versions up to, and including, 4.4.4 via the learnpress_create_page AJAX action. The LP_Admin_Ajax::create_page() handler only checks the edit_pages capability and a wp_rest nonce (both available to Editors), then reads the field_name parameter from the request without restricting it to a learn_press_* allow-list before passing it as the option key to LP_Helper::create_page(), which calls update_option($key_option, $page_id). This makes it possible for authenticated attackers, with Editor-level access and above, to update arbitrary WordPress options to a positive…
PLUGIN
Learnpress
CVE-2026-75982
Risk Score
Threat Entry
Updated 2026-08-26
LearnPress - Broken Access Control (CVE-2026-12976)
The LearnPress WordPress plugin before 4.4.4 does not verify that a user is enrolled in a course before processing AI-assistant requests against that course's lesson content, allowing any authenticated user such as a subscriber to obtain material from paid courses they have not enrolled in.
PLUGIN
LearnPress
CVE-2026-12976
Risk Score
Threat Entry
Updated 2026-08-26
LearnPress - Server-Side Request Forgery (SSRF) (CVE-2026-12971)
The LearnPress WordPress plugin before 4.4.4 does not validate a user-supplied URL before the server fetches it, allowing users with the instructor role to induce the server to issue requests to arbitrary external hosts, a blind and bounded server-side request forgery.
PLUGIN
LearnPress
CVE-2026-12971
Risk Score