WordPress Reset Course Progress For LearnDash plugin <= 1.3 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Reset Course Progress For LearnDash plugin versions = 1.3. Solution No patched version available...

WordPress Reset Course Progress For LearnDash plugin <= 1.3 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Reset Course Progress For LearnDash plugin versions = 1.3. Solution No patched version available...

CVE-2018-25019

The LearnDash LMS WordPress plugin before 2.5.4 does not have any authorisation and validation of the file to be uploaded in the learndashassignmentprocessinit function, which could allow unauthenticated users to upload arbitrary files to the web server...

CVE-2018-25019

The LearnDash LMS WordPress plugin before 2.5.4 does not have any authorisation and validation of the file to be uploaded in the learndashassignmentprocessinit function, which could allow unauthenticated users to upload arbitrary files to the web server...

Input validation

The LearnDash LMS WordPress plugin before 2.5.4 does not have any authorisation and validation of the file to be uploaded in the learndashassignmentprocessinit function, which could allow unauthenticated users to upload arbitrary files to the web server...

CVE-2018-25019 LearnDash < 2.5.4 - Unauthenticated Arbitrary File Upload

The LearnDash LMS WordPress plugin before 2.5.4 does not have any authorisation and validation of the file to be uploaded in the learndashassignmentprocessinit function, which could allow unauthenticated users to upload arbitrary files to the web server...

CVE-2018-25019

CVE-2018-25019 affects the LearnDash LMS WordPress plugin (versions before 2.5.4). The root cause is lack of authorization/validation for uploaded files in learndash_assignment_process_init(), enabling unauthenticated users to upload arbitrary files to the web server. Impact is arbitrary file upl...

WordPress 安全漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security vulnerability exists in the WordPress plugin LearnDash LMS prior to version 2.5.4. The...

PT-2021-8848

Name of the Vulnerable Software and Affected Versions LearnDash LMS WordPress plugin versions prior to 2.5.4 Description The issue concerns a lack of authorization and validation for file uploads in the learndash assignment process init function. This could allow unauthenticated users to upload...

CVE-2018-25019: Unrestricted Upload of File with Dangerous Type

The LearnDash LMS WordPress plugin before 2.5.4 does not have any authorisation and validation of the file to be uploaded in the learndashassignmentprocessinit function, which could allow unauthenticated users to upload arbitrary files to the web server...

CVE-2020-35650

Multiple cross-site scripting XSS vulnerabilities in Uncanny Groups for LearnDash before v3.7 allow authenticated remote attackers to inject arbitrary JavaScript or HTML via the ulgmcoderedeem POST Parameter in user-code-redemption.php, the ulgmuserfirst POST Parameter in...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Uncanny Groups for LearnDash before v3.7 allow authenticated remote attackers to inject arbitrary JavaScript or HTML via the ulgmcoderedeem POST Parameter in user-code-redemption.php, the ulgmuserfirst POST Parameter in...

CVE-2020-9439

Multiple cross-site scripting XSS vulnerabilities in Uncanny Owl Tin Canny LearnDash Reporting before 3.4.4 allows authenticated remote attackers to inject arbitrary web script or HTML via the searchkey GET Parameter in TinCanContentListTable.php, message GET Parameter in licensing.php,...

CVE-2020-9439

Uncanny Owl Tin Canny LearnDash Reporting prior to 3.4.4 contains multiple XSS vulnerabilities exploitable by authenticated remote actors via several GET parameters (e.g., search_key in TinCan_Content_List_Table.php; licensing.php; tc_filter_* in reporting-admin-menu.php; tc_filter_data_range/ tc...

CVE-2020-35650

Multiple cross-site scripting XSS vulnerabilities in Uncanny Groups for LearnDash before v3.7 allow authenticated remote attackers to inject arbitrary JavaScript or HTML via the ulgmcoderedeem POST Parameter in user-code-redemption.php, the ulgmuserfirst POST Parameter in...

CVE-2020-35650

CVE-2020-35650 affects Uncanny Groups for LearnDash prior to v3.7, with multiple XSS vectors enabled by authenticated users. The vulnerability exists in various input points (POST parameters like ulgm_code_redeem, ulgm_user_first/last/email, ulgm_code_registration, ulgm_terms_conditions, _ulgm_to...

Uncanny Owl Tin Canny LearnDash Reporting Cross-Site Scripting Vulnerability

Uncanny Owl Tin Canny LearnDash Reporting is a plugin from Uncanny Owl Canada that provides learning record storage functionality for Wordpress. Uncanny Owl Tin Canny LearnDash Reporting before 3.4.4 has a security vulnerability that originates from the following script or parameter: searchkey GE...

PT-2020-17375

Name of the Vulnerable Software and Affected Versions Uncanny Groups for LearnDash versions prior to 3.7 Description Multiple cross-site scripting XSS vulnerabilities allow authenticated remote attackers to inject arbitrary JavaScript or HTML via various parameters. The affected parameters includ...

PT-2020-20660

Name of the Vulnerable Software and Affected Versions Uncanny Owl Tin Canny LearnDash Reporting versions prior to 3.4.4 Description The issue allows authenticated remote attackers to inject arbitrary web script or HTML via several parameters, including the search key GET parameter in TinCan Conte...

CVE-2020-9439: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Uncanny Owl Tin Canny LearnDash Reporting before 3.4.4 allows authenticated remote attackers to inject arbitrary web script or HTML via the searchkey GET Parameter in TinCanContentListTable.php, message GET Parameter in licensing.php,...