CVE-2026-12153

CVE-2026-12153 affects the WordPress WP Learn Manager plugin up to version 1.1.8. The vulnerability is an authorization bypass in the jslearnmanager_ajax AJAX action, allowing unauthenticated attackers to install and activate arbitrary plugins from the WordPress.org repository on affected sites. ...

CVE-2021-47975

Vulnerability summary (CVE-2021-47975) : The WordPress plugin WP Learn Manager 1.1.2 contains a stored cross-site scripting (XSS) flaw in the fieldtitle parameter. An unauthenticated attacker can submit POST requests to the jslm_fieldordering page with XSS payloads in fieldtitle, enabling arbitra...

WordPress WP Learn Manager plugin <= 1.1.4 - Unauthenticated Arbitrary User Field Edition/Creation vulnerability

Unauthenticated Arbitrary User Field Edition/Creation vulnerability discovered in WordPress WP Learn Manager plugin versions = 1.1.4. Solution Update the WordPress WP Learn Manager plugin to the latest available version at least 1.1.5. Version 1.1.5 added CSRF, but still no capability check...