WordPress LearnDash LMS Plugin <= 4.5.3 is vulnerable to SQL Injection

Software LearnDash LMS Type Plugin Vulnerable versions = 4.5.3 Fixed in 4.5.3.1 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-28777 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID badba795df6c Credits Rafie Muhammad Patchstack Required privilege...

WordPress Uncanny Toolkit for LearnDash Plugin <= 3.6.4.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software Uncanny Toolkit for LearnDash Type Plugin Vulnerable versions = 3.6.4.1 Fixed in 3.6.4.2 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-23714 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 7ec3b9ffa1ec Credits...

WordPress Reset Course Progress For LearnDash plugin <= 1.3 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Reset Course Progress For LearnDash plugin versions = 1.3. Solution No patched version available...

WordPress Easy Settings for LearnDash plugin <= 1.2.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Easy Settings for LearnDash plugin versions = 1.2.1. Solution Update the WordPress Easy Settings for LearnDash plugin to the latest available version at least 1.3.0...

WordPress Drip Feed Content Extended for Learndash plugin <= 1.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Drip Feed Content Extended for Learndash plugin versions = 1.1. Solution No patched version available...

WordPress Reset Course Progress For LearnDash plugin <= 1.3 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Reset Course Progress For LearnDash plugin versions = 1.3. Solution No patched version available...

WordPress Drip Feed Content Extended for Learndash plugin <= 1.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Drip Feed Content Extended for Learndash plugin versions = 1.1. Solution No patched version available...

WordPress Frontend group restriction for LearnDash plugin <= 1.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Frontend group restriction for LearnDash plugin versions = 1.1. Solution No patched version available...

WordPress Easy Settings for LearnDash plugin <= 1.2.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Easy Settings for LearnDash plugin versions = 1.2.1. Solution Update the WordPress Easy Settings for LearnDash plugin to the latest available version at least 1.3.0...

WordPress Frontend group restriction for LearnDash plugin <= 1.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Frontend group restriction for LearnDash plugin versions = 1.1. Solution No patched version available...

CVE-2018-25019

The LearnDash LMS WordPress plugin before 2.5.4 does not have any authorisation and validation of the file to be uploaded in the learndashassignmentprocessinit function, which could allow unauthenticated users to upload arbitrary files to the web server...

CVE-2018-25019

The LearnDash LMS WordPress plugin before 2.5.4 does not have any authorisation and validation of the file to be uploaded in the learndashassignmentprocessinit function, which could allow unauthenticated users to upload arbitrary files to the web server...

Input validation

The LearnDash LMS WordPress plugin before 2.5.4 does not have any authorisation and validation of the file to be uploaded in the learndashassignmentprocessinit function, which could allow unauthenticated users to upload arbitrary files to the web server...

CVE-2018-25019

CVE-2018-25019 affects the LearnDash LMS WordPress plugin (versions before 2.5.4). The root cause is lack of authorization/validation for uploaded files in learndash_assignment_process_init(), enabling unauthenticated users to upload arbitrary files to the web server. Impact is arbitrary file upl...

CVE-2018-25019 LearnDash < 2.5.4 - Unauthenticated Arbitrary File Upload

The LearnDash LMS WordPress plugin before 2.5.4 does not have any authorisation and validation of the file to be uploaded in the learndashassignmentprocessinit function, which could allow unauthenticated users to upload arbitrary files to the web server...

WordPress 安全漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security vulnerability exists in the WordPress plugin LearnDash LMS prior to version 2.5.4. The...

CVE-2020-35650

Multiple cross-site scripting XSS vulnerabilities in Uncanny Groups for LearnDash before v3.7 allow authenticated remote attackers to inject arbitrary JavaScript or HTML via the ulgmcoderedeem POST Parameter in user-code-redemption.php, the ulgmuserfirst POST Parameter in...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Uncanny Groups for LearnDash before v3.7 allow authenticated remote attackers to inject arbitrary JavaScript or HTML via the ulgmcoderedeem POST Parameter in user-code-redemption.php, the ulgmuserfirst POST Parameter in...

CVE-2020-9439

Uncanny Owl Tin Canny LearnDash Reporting prior to 3.4.4 contains multiple XSS vulnerabilities exploitable by authenticated remote actors via several GET parameters (e.g., search_key in TinCan_Content_List_Table.php; licensing.php; tc_filter_* in reporting-admin-menu.php; tc_filter_data_range/ tc...

CVE-2020-9439

Multiple cross-site scripting XSS vulnerabilities in Uncanny Owl Tin Canny LearnDash Reporting before 3.4.4 allows authenticated remote attackers to inject arbitrary web script or HTML via the searchkey GET Parameter in TinCanContentListTable.php, message GET Parameter in licensing.php,...