304 matches found
CVE-2022-0441
A vulnerability classified as critical was found in MasterStudy LMS Plugin up to 2.7.5 on WordPress WordPress Plugin. This vulnerability affects an unknown part of the component New Account Handler. The manipulation with an unknown input leads to a privileges management vulnerability. The CWE...
LearnPress < 4.2.7.4 - Course Material - Information Disclosure
LearnPress – WordPress LMS Plugin contains a sensitive information exposure caused by insecure handling in class-lp-rest-material-controller.php, letting unauthenticated attackers extract paid course material, exploit requires no authentication. id: CVE-2024-11868 info: name: LearnPress 4.2.7.4 -...
CVE-2026-107744
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.10 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible...
EUVD-2026-103230
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.10 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible...
CVE-2026-109208
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'quantity REST / ordercomments checkout' parameter in all versions up to, and including, 4.4.10 due to insufficient input sanitization and output...
EUVD-2026-103216
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'quantity REST / ordercomments checkout' parameter in all versions up to, and including, 4.4.10 due to insufficient input sanitization and output...
CVE-2026-109208: Improper Neutralization of Input During Web Page Generation
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'quantity REST / ordercomments checkout' parameter in all versions up to, and including, 4.4.10 due to insufficient input sanitization and output...
PT-2026-116199
Name of the Vulnerable Software and Affected Versions LearnPress versions prior to 4.4.11 Description Insufficient input sanitization and output escaping allow for Stored Cross-Site Scripting. This occurs via the quantity parameter in the REST API and the order comments parameter during checkout...
CVE-2026-107744: Missing Authorization
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.10 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible...
PT-2026-116353
Name of the Vulnerable Software and Affected Versions LearnPress – WordPress LMS Plugin for Create and Sell Online Courses versions prior to 4.4.11 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions...
CVE-2026-92538
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'orderby' parameter in all versions up to, and including, 4.4.7 due to insufficient input sanitization and output escaping. This makes it...
EUVD-2026-91895
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'orderby' parameter in all versions up to, and including, 4.4.7 due to insufficient input sanitization and output escaping. This makes it...
CVE-2026-92538
The LearnPress – WordPress LMS Plugin for WordPress (versions up to and including 4.4.7 ) is vulnerable to Reflected DOM-Based Cross-Site Scripting . The flaw exists in the 'orderby' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbit...
PT-2026-104489
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'orderby' parameter in all versions up to, and including, 4.4.7 due to insufficient input sanitization and output escaping. This makes it...
CVE-2026-92538: Improper Neutralization of Input During Web Page Generation
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'orderby' parameter in all versions up to, and including, 4.4.7 due to insufficient input sanitization and output escaping. This makes it...
CVE-2026-93882
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.4.8 via the CourseMaterialTemplate::rendermaterialitems callback exposed on the public lp-ajax-handle...
EUVD-2026-90544
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.4.8 via the CourseMaterialTemplate::rendermaterialitems callback exposed on the public lp-ajax-handle...
CVE-2026-93882: Authorization Bypass Through User-Controlled Key
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.4.8 via the CourseMaterialTemplate::rendermaterialitems callback exposed on the public lp-ajax-handle...
PT-2026-103719
Name of the Vulnerable Software and Affected Versions LearnPress – WordPress LMS Plugin for Create and Sell Online Courses versions prior to 4.4.9 Description An Insecure Direct Object Reference exists via the CourseMaterialTemplate::render material items callback exposed on the public...