Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-07-23
Learnpress Import Export - PHP Object Injection (CVE-2026-7566)
The LearnPress – Backup & Migration Tool plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.1.4 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme…
PLUGIN
Learnpress Import Export
CVE-2026-7566
Risk Score
Threat Entry
Updated 2026-07-23
Learnpress Import Export - Path Traversal (CVE-2026-7565)
The LearnPress – Backup & Migration Tool plugin for WordPress is vulnerable to Arbitrary File Read via Directory Traversal in all versions up to, and including, 4.1.4 via the 'import-user-file' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
PLUGIN
Learnpress Import Export
CVE-2026-7565
Risk Score
Threat Entry
Updated 2026-06-17
Learnpress Import Export - Broken Access Control (CVE-2026-1787)
The LearnPress Export Import – WordPress extension for LearnPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'delete_migrated_data' function in all versions up to, and including, 4.1.0. This makes it possible for unauthenticated attackers to delete course that have been migrated from Tutor LMS. The Tutor LMS plugin must be installed and activated in order to exploit the vulnerability.
PLUGIN
Learnpress Import Export
CVE-2026-1787
Risk Score
Threat Entry
Updated 2026-06-17
Learnpress Import Export - Path Traversal (CVE-2025-60200)
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThimPress LearnPress Export Import learnpress-import-export allows PHP Local File Inclusion.This issue affects LearnPress Export Import: from n/a through
PLUGIN
Learnpress Import Export
CVE-2025-60200
Risk Score
Threat Entry
Updated 2026-06-17
Learnpress Import Export - Cross-Site Scripting (XSS) (CVE-2025-49992)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress LearnPress Export Import learnpress-import-export allows Reflected XSS.This issue affects LearnPress Export Import: from n/a through
PLUGIN
Learnpress Import Export
CVE-2025-49992
Risk Score
Threat Entry
Updated 2026-06-17
Learnpress Import Export - Cross-Site Scripting (XSS) (CVE-2024-9609)
The LearnPress Export Import – WordPress extension for LearnPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'learnpress_import_form_server' parameter in all versions up to, and including, 4.0.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
PLUGIN
Learnpress Import Export
CVE-2024-9609
Risk Score