274 matches found
WordPress LearnPress Plugin <= 4.2.6.3 is vulnerable to Cross Site Scripting (XSS)
Software LearnPress Type Plugin Vulnerable versions = 4.2.6.3 Fixed in 4.2.6.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-1463 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 652c7a60489a Credits drop Required privilege L...
CVE-2023-5558
The LearnPress WordPress plugin before 4.2.5.5 does not sanitise and escape user input before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
WordPress plugin LearnPress Security Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...
CVE-2023-6634
The LearnPress plugin for WordPress is vulnerable to Command Injection in all versions up to, and including, 4.2.5.7 via the getcontent function. This is due to the plugin making use of the calluserfunc function with user input. This makes it possible for unauthenticated attackers to execute any...
Sql injection
The LearnPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 4.2.5.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...
CVE-2023-6634 LearnPress <= 4.2.5.7 - Command Injection
The LearnPress plugin for WordPress is vulnerable to Command Injection in all versions up to, and including, 4.2.5.7 via the getcontent function. This is due to the plugin making use of the calluserfunc function with user input. This makes it possible for unauthenticated attackers to execute any...
CVE-2023-6223
The LearnPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.5.7 via the /wp-json/lp/v1/profile/course-tab REST API due to missing validation on the 'userID' user controlled key. This makes it possible for authenticated attackers,...
Exploit for SQL Injection in Thimpress Learnpress
CVE-2023-6567-poc Time-based SQLi Description The plugin does...
PT-2024-15010 · WordPress · Learnpress
Name of the Vulnerable Software and Affected Versions: LearnPress plugin for WordPress versions up to, and including, 4.2.5.7 Description: The issue is related to time-based SQL Injection via the order by parameter due to insufficient escaping on the user supplied parameter and lack of sufficient...
WordPress Plugin LearnPress Security Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...
PT-2024-14901
Name of the Vulnerable Software and Affected Versions LearnPress plugin for WordPress versions up to, and including, 4.2.5.7 Description The issue allows authenticated attackers with subscriber-level access and above to retrieve the details of another user's course progress due to missing...
PT-2024-4517 · WordPress · Learnpress
Name of the Vulnerable Software and Affected Versions: LearnPress plugin for WordPress versions up to, and including, 4.2.5.7 Description: The issue is related to the LearnPress plugin for WordPress, which is vulnerable to command injection in all versions up to, and including, 4.2.5.7. This...
WordPress LearnPress Plugin <= 4.2.5.7 is vulnerable to Insecure Direct Object References (IDOR)
Software LearnPress Type Plugin Vulnerable versions = 4.2.5.7 Fixed in 4.2.5.8 OWASP Top 10 A1: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2023-6223 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID d81a8f21bcf7 Credits lttn Required...
LearnPress < 4.2.5.5 - Reflected Cross-Site Scripting
Description The plugin does not sanitise and escape user input before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. PoC Make a logged in admin open v...
LearnPress Plugin XSS
The vulnerability of the LearnPress plugin for WordPress content management systems exists due to the lack of measures taken to protect the website’s structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...
Exploit for SQL Injection in Thimpress Learnpress
CVE-2022-45808 LearnPress Plugin 4.2.0 - Unauthenticated...
Exploit for Unrestricted Upload of File with Dangerous Type in Thimpress Learnpress
CVE-2022-47615 LearnPress Plugin 4.2.0 - Unauthenticated...
WordPress LearnPress Plugin <= 4.2.3 is vulnerable to Broken Access Control
Software LearnPress Type Plugin Vulnerable versions = 4.2.3 Fixed in 4.2.3.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-36516 Patch priority High CVSS severity High 7.6 Developer Claim ownership PSID 9d39c7dfcdce Credits Rafie Muhammad Patchstack...
WordPress LearnPress Plugin <= 4.2.3 is vulnerable to Broken Access Control
Software LearnPress Type Plugin Vulnerable versions = 4.2.3 Fixed in 4.2.3.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-36515 Patch priority High CVSS severity High 7.3 Developer Claim ownership PSID 5c7b12ada2f1 Credits Rafie Muhammad Patchstack...