# LearnPress – WordPress LMS Plugin for Create and Sell Online Courses

> A WordPress LMS Plugin to create WordPress Learning Management System. Turn your WordPress to LMS WordPress Website with Courses, Lessons, Quizzes &am …

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-13 11:25 UTC.

## Facts (WordPress.org)

- Slug: `learnpress`
- Author: ThimPress
- Version: 4.4.13
- Active installs: 60,000+
- Last update: 2026-10-30 (15 days ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 6.0, PHP 7.4
- Tags: course, education, elearning, learning management system, lms
- Page: https://wordpress.org/plugins/learnpress/

## Checks (against WordPress 7.1.4)

- OK: Updated 15 days ago.
- OK: Tested with WordPress 7.1.
- OK: Runs on any PHP WordPress supports (PHP 7.4+).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Leaky ↔ Spam-proof, Locked in ↔ Portable, Inaccessible ↔ Accessible, Slow ↔ Responsive, Paywalled ↔ Generous, Steep ↔ Easy.

## Known vulnerabilities

- 2026-11-07 MEDIUM: Missing Authorization (up to 4.4.12). CVE-2026-52713, https://www.wordfence.com/threat-intel/vulnerabilities/id/3a09414a-9f20-4f88-8d9f-20699a9b7171?source=api-prod
- 2026-10-29 MEDIUM: Missing Authorization (up to 4.4.10). CVE-2026-42690, https://www.wordfence.com/threat-intel/vulnerabilities/id/1239fa45-f914-4922-ac4e-c0753553730a?source=api-prod
- 2026-10-26 MEDIUM: Missing Authorization (up to 4.4.11). CVE-2026-115597, https://www.wordfence.com/threat-intel/vulnerabilities/id/e36cbd03-6e7b-4c5d-a5be-6980f312d918?source=api-prod
- 2026-10-26 MEDIUM: Missing Authorization (up to 4.4.11). CVE-2026-115598, https://www.wordfence.com/threat-intel/vulnerabilities/id/a903c260-5872-4c2a-ac77-037985880c24?source=api-prod
- 2026-10-20 MEDIUM: Authenticated (Custom+) Insecure Direct Object Reference (before 4.4.10). CVE-2026-113353, https://www.wordfence.com/threat-intel/vulnerabilities/id/043db2aa-368a-4925-81e8-0ad87a1efa16?source=api-prod
- 2026-10-19 MEDIUM: Missing Authorization (up to 4.4.10). CVE-2026-110363, https://www.wordfence.com/threat-intel/vulnerabilities/id/5c578284-006a-4bb5-a00b-295c67915f5f?source=api-prod
- 2026-10-17 HIGH: Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' Parameters (up to 4.4.10). CVE-2026-109208, https://www.wordfence.com/threat-intel/vulnerabilities/id/4ac1ddf0-9164-45a8-b1dc-e684b1b4b447?source=api-prod
- 2026-10-17 CRITICAL: Unauthenticated PHP Object Injection via 'checkout-email' Parameter (up to 4.4.10). CVE-2026-104736, https://www.wordfence.com/threat-intel/vulnerabilities/id/3e28e008-0ec1-4262-9ac0-6170cf8b8bdf?source=api-prod
- 2026-10-17 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via 'search-authors' AJAX Action (up to 4.4.10). CVE-2026-107744, https://www.wordfence.com/threat-intel/vulnerabilities/id/d1894596-b430-41b3-9d28-12c7dea7ff9b?source=api-prod
- 2026-10-06 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 4.4.9). CVE-2026-104670, https://www.wordfence.com/threat-intel/vulnerabilities/id/46217022-f16a-46c9-abca-680b7e35948c?source=api-prod
- 2026-10-05 MEDIUM: Authenticated (Instructor+) Stored Cross-Site Scripting (up to 4.4.9.1). CVE-2026-105397, https://www.wordfence.com/threat-intel/vulnerabilities/id/c16b6063-03b0-42c3-8e45-36ad3fe2760b?source=api-prod
- 2026-10-03 MEDIUM: Reflected DOM-Based Cross-Site Scripting via 'orderby' Parameter (up to 4.4.7). CVE-2026-92538, https://www.wordfence.com/threat-intel/vulnerabilities/id/b011448b-0598-4b9a-b558-d7be13802ebf?source=api-prod
- 2026-10-02 MEDIUM: Unauthenticated Insecure Direct Object Reference (up to 4.4.9). CVE-2026-104403, https://www.wordfence.com/threat-intel/vulnerabilities/id/9d453688-0bd4-4c4f-a422-8e4d67361c9a?source=api-prod
- 2026-10-02 MEDIUM: Missing Authorization (up to 4.4.10). CVE-2026-39717, https://www.wordfence.com/threat-intel/vulnerabilities/id/2158052d-aff0-4492-94a4-a0ffe3dd013c?source=api-prod
- 2026-10-01 HIGH: Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'item_id' Parameter (up to 4.4.8). CVE-2026-93882, https://www.wordfence.com/threat-intel/vulnerabilities/id/1f35f646-1bd6-4785-bdc2-c815644b2b2d?source=api-prod
- 2026-09-17 MEDIUM: Unauthenticated Information Exposure (4.4.3 to 4.4.6). CVE-2026-86446, https://www.wordfence.com/threat-intel/vulnerabilities/id/b1282482-3b41-423a-bff5-a82471fafc23?source=api-prod
- 2026-09-16 MEDIUM: Reflected Cross-Site Scripting (up to 4.4.6). CVE-2026-86444, https://www.wordfence.com/threat-intel/vulnerabilities/id/ef089712-f717-4023-a0e4-d7924c904aa3?source=api-prod
- 2026-09-16 MEDIUM: Unauthenticated Information Exposure (up to 4.4.6). CVE-2026-86445, https://www.wordfence.com/threat-intel/vulnerabilities/id/6d3aff16-73f0-4c1a-9838-6fd6ec69a39f?source=api-prod
- 2026-09-16 MEDIUM: Unauthenticated Information Exposure (up to 4.4.6). CVE-2026-86447, https://www.wordfence.com/threat-intel/vulnerabilities/id/7c5248cc-6676-46cb-846b-a2c246425a54?source=api-prod
- 2026-09-16 MEDIUM: Unauthenticated Information Exposure (up to 4.4.6). CVE-2026-86448, https://www.wordfence.com/threat-intel/vulnerabilities/id/0ba153e1-b46c-404d-81ec-21bc7dfa3d8a?source=api-prod
- 2026-09-16 MEDIUM: Unauthenticated Information Exposure (up to 4.4.6). CVE-2026-86449, https://www.wordfence.com/threat-intel/vulnerabilities/id/9f8b9b63-e858-44f1-bbb6-b2011bd08691?source=api-prod
- 2026-09-08 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via 'layout_custom_css' (up to 4.3.9.1). CVE-2026-12230, https://www.wordfence.com/threat-intel/vulnerabilities/id/9f662888-c388-4191-bda9-b8a22d63cb3f?source=api-prod
- 2026-09-03 MEDIUM: Missing Authorization (up to 4.4.5). CVE-2026-82023, https://www.wordfence.com/threat-intel/vulnerabilities/id/b5892b38-b46b-4aab-89d4-ba70369b8526?source=api-prod
- 2026-09-03 MEDIUM: Authenticated (Instructor+) Stored Cross-Site Scripting (up to 4.4.5). CVE-2026-82024, https://www.wordfence.com/threat-intel/vulnerabilities/id/e1aff11b-0519-4712-b3ac-03e1612a69c1?source=api-prod
- 2026-09-01 MEDIUM: Authenticated (Administrator+) SQL Injection via 'orderby' Parameter (up to 4.4.4). CVE-2026-77823, https://www.wordfence.com/threat-intel/vulnerabilities/id/dfd960b6-34c9-48b0-9259-46da50754956?source=api-prod
- 2026-08-25 MEDIUM: Missing Authorization to Authenticated (Editor+) Limited Option Update via 'field_name' Parameter (up to 4.4.4). CVE-2026-75982, https://www.wordfence.com/threat-intel/vulnerabilities/id/2f8b8bfe-8d73-4289-b212-7baf7bceaaf6?source=api-prod
- 2026-08-12 MEDIUM: Authenticated (Subscriber+) Information Exposure (before 4.4.4). CVE-2026-12976, https://www.wordfence.com/threat-intel/vulnerabilities/id/95ae7cb4-3434-4c75-a803-81ae96ba5891?source=api-prod
- 2026-08-10 MEDIUM: Authenticated (Instructor+) Server-Side Request Forgery (up to 4.4.3). CVE-2026-12971, https://www.wordfence.com/threat-intel/vulnerabilities/id/7f96a16e-0ae5-421e-b3d3-7299a5f99e1d?source=api-prod
- 2026-07-20 MEDIUM: Reflected Cross-Site Scripting (up to 4.4.0). CVE-2026-12970, https://www.wordfence.com/threat-intel/vulnerabilities/id/8d2a1774-1deb-42ac-bae5-7d33d39023c0?source=api-prod
- 2026-07-17 HIGH: Missing Authorization to Unauthenticated Sensitive Information Exposure via /lp/v1/users/check-answer and /start-quiz REST Endpoints (up to 4.4.1). CVE-2026-13765, https://www.wordfence.com/threat-intel/vulnerabilities/id/ee3bbf20-43fd-4977-b0ba-b81e7a3810d0?source=api-prod
- 2026-07-01 MEDIUM: Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'userId' Parameter (up to 4.3.9.1). CVE-2026-11988, https://www.wordfence.com/threat-intel/vulnerabilities/id/6b5e8cfd-989e-4a64-abb0-9daa22df46a4?source=api-prod
- 2026-07-01 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via 'class_wrapper_form' Shortcode Attribute (up to 4.4.0). CVE-2026-12732, https://www.wordfence.com/threat-intel/vulnerabilities/id/09c8db69-60fa-4087-9096-5d34ce44f616?source=api-prod
- 2026-06-17 MEDIUM: Missing Authorization to Unauthenticated Sensitive User Information Disclosure (up to 4.3.6). CVE-2026-8383, https://www.wordfence.com/threat-intel/vulnerabilities/id/0a8453c4-effd-48fc-99c8-fc1f90cd23ea?source=api-prod
- 2026-06-06 MEDIUM: Unauthenticated Sensitive Information Exposure via 'c_status' and 'return_type' Parameters (up to 4.3.6). CVE-2026-8502, https://www.wordfence.com/threat-intel/vulnerabilities/id/a32a6ea3-4473-4075-b660-9bba083ae0bf?source=api-prod
- 2026-06-01 MEDIUM: Reflected Cross-Site Scripting (up to 4.3.6). CVE-2026-48865, https://www.wordfence.com/threat-intel/vulnerabilities/id/2e78bcfd-9764-49ae-9cac-cbc5419a0aa5?source=api-prod
- 2026-05-14 MEDIUM: Authenticated (Subscriber+) Payment Bypass to Free Course Enrollment via 'quantity' Parameter (up to 4.3.5). CVE-2026-7648, https://www.wordfence.com/threat-intel/vulnerabilities/id/564ec4a6-20d3-4b46-8637-fc1de586e19a?source=api-prod
- 2026-04-14 CRITICAL: Missing Authorization to Unauthenticated Arbitrary Quiz Answer Deletion (up to 4.3.2.8). CVE-2026-4365, https://www.wordfence.com/threat-intel/vulnerabilities/id/021bd566-1663-46ba-a616-ab554b691cbb?source=api-prod
- 2026-04-07 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via 'skin' Shortcode Attribute (up to 4.3.3). CVE-2026-4333, https://www.wordfence.com/threat-intel/vulnerabilities/id/15fb0a26-e415-4ccb-b83d-d8f7b36bce66?source=api-prod
- 2026-03-23 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Answer Deletion (up to 4.3.2.8). CVE-2026-3225, https://www.wordfence.com/threat-intel/vulnerabilities/id/fc4afb78-fca6-4cc2-8e64-4785d93055e6?source=api-prod
- 2026-03-11 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Notification Triggering (up to 4.3.2.8). CVE-2026-3226, https://www.wordfence.com/threat-intel/vulnerabilities/id/520018db-d33b-4f2c-aaa5-611de792e11f?source=api-prod
- 2026-01-19 MEDIUM: Missing Authorization to Unauthenticated Sensitive User Information Disclosure via REST API (up to 4.3.2.4). CVE-2025-14798, https://www.wordfence.com/threat-intel/vulnerabilities/id/6fb00ce4-aa82-4479-b7f6-79e7bde098c1?source=api-prod
- 2026-01-06 MEDIUM: Insecure Direct Object Reference to Authenticated (Instructor+) Teacher Material Deletion (up to 4.3.2.1). CVE-2025-14802, https://www.wordfence.com/threat-intel/vulnerabilities/id/884c4508-1ee1-4384-9fc2-29e2c9042426?source=api-prod
- 2026-01-05 MEDIUM: Missing Authentication to Unauthenticated Course Modification (up to 4.3.2). CVE-2025-13964, https://www.wordfence.com/threat-intel/vulnerabilities/id/ae363511-8a1f-476a-9851-61f7763428c2?source=api-prod
- 2025-12-15 MEDIUM: Missing Authorization to Unauthenticated Orders Statistics Exposure (up to 4.3.1). CVE-2025-13956, https://www.wordfence.com/threat-intel/vulnerabilities/id/c4b833c3-818d-4646-bd6d-8b3be13ea0f1?source=api-prod
- 2025-12-15 MEDIUM: Authenticated (Subscriber+) Stored Cross-Site Scripting via get_profile_social (up to 4.3.1). CVE-2025-14387, https://www.wordfence.com/threat-intel/vulnerabilities/id/f29b3a37-436d-4d03-8818-d5267b23067b?source=api-prod
- 2025-11-30 MEDIUM: Missing Authorization (up to 4.2.9.4). CVE-2025-66054, https://www.wordfence.com/threat-intel/vulnerabilities/id/f46c8075-3946-406c-b4c9-ae44617207f1?source=api-prod
- 2025-11-20 MEDIUM: Missing Authorization to Unauthenticated Arbitrary Callback Execution to Information Exposure (up to 4.2.9.4). CVE-2025-11368, https://www.wordfence.com/threat-intel/vulnerabilities/id/0c9856db-3779-4649-9a48-1c7b6d019816?source=api-prod
- 2025-11-06 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 4.2.9.4). CVE-2025-67536, https://www.wordfence.com/threat-intel/vulnerabilities/id/ed8408b0-b14c-4f01-abdd-e7019dd985b4?source=api-prod
- 2025-10-17 MEDIUM: Missing Authorization to Unauthenticated Database Table Manipulation (up to 4.2.9.3). CVE-2025-11372, https://www.wordfence.com/threat-intel/vulnerabilities/id/d2365e92-d70d-47fa-9abe-7cbdd6336f39?source=api-prod
- 2025-03-27 MEDIUM: Missing Authorization (up to 4.2.7.5). CVE-2025-22739, https://www.wordfence.com/threat-intel/vulnerabilities/id/e54e199a-410f-402d-bdd0-14685e2ca3fc?source=api-prod
- 2025-01-29 MEDIUM: Authenticated (Admin+) Stored Cross-Site Scripting (up to 4.2.7.5). CVE-2024-13127, https://www.wordfence.com/threat-intel/vulnerabilities/id/0a79f8f6-a708-4db1-806d-1f782bbcfd16?source=api-prod
- 2025-01-29 MEDIUM: Authenticated (Admin+) Stored Cross-Site Scripting (up to 4.2.7.5). CVE-2024-13128, https://www.wordfence.com/threat-intel/vulnerabilities/id/69bbe342-4969-4f82-aacb-7fd7bf65a75c?source=api-prod
- 2025-01-24 MEDIUM: Authenticated (LP Instructor+) Stored Cross-Site Scripting via Lesson Name (up to 4.2.7.5). CVE-2024-13599, https://www.wordfence.com/threat-intel/vulnerabilities/id/67709117-8912-4c09-afcb-0c07345d00e0?source=api-prod
- 2025-01-24 MEDIUM: Authenticated (Subscriber+) Open Redirect (up to 4.2.7.1). CVE-2025-24740, https://www.wordfence.com/threat-intel/vulnerabilities/id/a1702bdd-1409-42f7-b7b8-cfd44505ecd6?source=api-prod
- 2024-12-09 MEDIUM: Course Material Sensitive Information Exposure via REST API (up to 4.2.7.3). CVE-2024-11868, https://www.wordfence.com/threat-intel/vulnerabilities/id/7bd43980-9193-4a63-adba-720dd1b11699?source=api-prod
- 2024-11-21 MEDIUM: Authenticated (Admin+) Stored Cross-Site Scripting (up to 4.2.7.1). CVE-2024-10010, https://www.wordfence.com/threat-intel/vulnerabilities/id/68991289-acfa-4ab9-9852-755e5f1eda33?source=api-prod
- 2024-11-21 MEDIUM: Authenticated (Admin+) Stored Cross-Site Scripting (up to 4.2.7.1). CVE-2024-9881, https://www.wordfence.com/threat-intel/vulnerabilities/id/ae66f460-ca84-49fb-9ef0-46bcca77996b?source=api-prod
- 2024-09-11 CRITICAL: Unauthenticated SQL Injection via 'c_fields' (up to 4.2.7). CVE-2024-8529, https://www.wordfence.com/threat-intel/vulnerabilities/id/c2b2671e-0db7-4ba9-b574-a0122959e8fc?source=api-prod
- 2024-09-11 CRITICAL: Unauthenticated SQL Injection via 'c_only_fields' (up to 4.2.7). CVE-2024-8522, https://www.wordfence.com/threat-intel/vulnerabilities/id/e495507d-7eac-4f38-ab6f-b8f0809b2be4?source=api-prod
- 2024-08-07 HIGH: Authenticated (Contributor+) SQL Injection via order Parameter (up to 4.2.6.9.3). CVE-2024-7548, https://www.wordfence.com/threat-intel/vulnerabilities/id/702715a9-b180-4d31-a1df-37b732ae8226?source=api-prod
- 2024-08-01 MEDIUM: Cross-Site Request Forgery (up to 4.2.6.8.2). CVE-2024-39641, https://www.wordfence.com/threat-intel/vulnerabilities/id/52d6f0c3-2e2e-44cb-a5ea-85c19424ddac?source=api-prod
- 2024-08-01 MEDIUM: Authenticated (Subscriber+) Insecure Direct Object Reference (up to 4.2.6.8.2). CVE-2024-39642, https://www.wordfence.com/threat-intel/vulnerabilities/id/7449ed1e-cc09-4b8b-8226-7cdc70be2b36?source=api-prod
- 2024-07-24 HIGH: Authenticated (Contributor+) Local File Inclusion (up to 4.2.6.8.2). CVE-2024-6589, https://www.wordfence.com/threat-intel/vulnerabilities/id/ba79bf95-08f8-4aa6-968b-f76a09ce52b8?source=api-prod
- 2024-07-01 MEDIUM: Missing Authorization to Unauthenticated User Registration Bypass (up to 4.2.6.8.1). CVE-2024-6088, https://www.wordfence.com/threat-intel/vulnerabilities/id/04e0ddff-16af-4c85-b5b0-cf767684ee08?source=api-prod
- 2024-07-01 MEDIUM: Unauthenticated Bypass to User Registration (up to 4.2.6.8.1). CVE-2024-6099, https://www.wordfence.com/threat-intel/vulnerabilities/id/7ee714c7-4c9b-4627-9ba9-f83aeca6a0a5?source=api-prod
- 2024-06-04 MEDIUM: Basic Information Disclosure via JSON API (up to 4.2.6.8). CVE-2024-5483, https://www.wordfence.com/threat-intel/vulnerabilities/id/122b75d2-e882-45b9-baf1-acf847f8d60a?source=api-prod
- 2024-05-21 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter (up to 4.2.6.6). CVE-2024-4971, https://www.wordfence.com/threat-intel/vulnerabilities/id/10b08a05-3561-4d05-985b-6a2339a547a7?source=api-prod
- 2024-05-09 CRITICAL: Unauthenticated Time-Based SQL Injection (up to 4.2.6.5). CVE-2024-4434, https://www.wordfence.com/threat-intel/vulnerabilities/id/2d64e1c6-1e25-4438-974d-b7da0979cc40?source=api-prod
- 2024-05-09 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via layout_html Parameter (up to 4.2.6.5). CVE-2024-4277, https://www.wordfence.com/threat-intel/vulnerabilities/id/46693edf-bcc6-4af8-9f26-5ede865f4694?source=api-prod
- 2024-05-09 MEDIUM: Unauthenticated Bypass to User Registration (up to 4.2.6.5). CVE-2024-4444, https://www.wordfence.com/threat-intel/vulnerabilities/id/c9e1410f-10c9-4654-8b61-cfcdde696da7?source=api-prod
- 2024-05-09 HIGH: Authenticated (Instructor+) Arbitrary File Upload (up to 4.2.6.5). CVE-2024-4397, https://www.wordfence.com/threat-intel/vulnerabilities/id/ec20d5c4-4c41-4ec9-8d0a-ec8f03634f7d?source=api-prod
- 2024-04-18 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 4.2.6.4). CVE-2024-3560, https://www.wordfence.com/threat-intel/vulnerabilities/id/8ea002da-bf37-4c6d-a46e-4f0e7f8968ad?source=api-prod
- 2024-04-04 MEDIUM: Insecure Direct Object Reference (up to 4.2.6.3). CVE-2024-1289, https://www.wordfence.com/threat-intel/vulnerabilities/id/0c410d91-08cc-496d-9c8e-c57f107399da?source=api-prod
- 2024-04-04 HIGH: Cross-Site Request Forgery to Privilege Escalation (up to 4.0.0). CVE-2024-2115, https://www.wordfence.com/threat-intel/vulnerabilities/id/342a4482-f5d3-4cc9-a998-e3abac7142cf?source=api-prod
- 2024-04-04 MEDIUM: Authenticated(LP Instructor+) Stored Cross-Site Scripting (up to 4.2.6.3). CVE-2024-1463, https://www.wordfence.com/threat-intel/vulnerabilities/id/abb4b617-884b-4e72-812f-5f23a0976ab6?source=api-prod
- 2024-01-03 HIGH: Command Injection (up to 4.2.5.7). CVE-2023-6634, https://www.wordfence.com/threat-intel/vulnerabilities/id/21291ed7-cdc0-4698-9ec4-8417160845ed?source=api-prod
- 2024-01-02 MEDIUM: Insecure Direct Object Reference to Information Disclosure (up to 4.2.5.7). CVE-2023-6223, https://www.wordfence.com/threat-intel/vulnerabilities/id/215d5d9e-dabb-462d-8c51-952f8c497b78?source=api-prod
- 2024-01-02 CRITICAL: Unauthenticated SQL Injection via order_by (up to 4.2.5.7). CVE-2023-6567, https://www.wordfence.com/threat-intel/vulnerabilities/id/6ab578cd-3a0b-43d3-aaa7-0a01f431a4e2?source=api-prod
- 2023-11-07 MEDIUM: Reflected Cross-Site Scripting via add_internal_scripts_to_head (before 4.2.5.4). CVE-2023-5558, https://www.wordfence.com/threat-intel/vulnerabilities/id/81fd3ac1-91af-4cfa-ac4e-712beb4236c0?source=api-prod
- 2023-07-06 MEDIUM: Missing Authorization (before 4.2.3.1). WF-389277fd-e47e-42df-9305-61ceedbcfb29, https://www.wordfence.com/threat-intel/vulnerabilities/id/389277fd-e47e-42df-9305-61ceedbcfb29?source=api-prod
- 2023-07-04 MEDIUM: Missing Authorization (up to 4.2.3). CVE-2023-36516, https://www.wordfence.com/threat-intel/vulnerabilities/id/e91e864a-20f6-48a2-ab9f-d20836207383?source=api-prod
- 2023-07-04 HIGH: Missing Authorization to Information Exposure (up to 4.2.3). CVE-2023-36515, https://www.wordfence.com/threat-intel/vulnerabilities/id/ea136a60-aa42-4577-88b6-a49c79098954?source=api-prod
- 2023-01-20 CRITICAL: Unauthenticated SQL Injection (up to 4.1.7.3.2). CVE-2022-45808, https://www.wordfence.com/threat-intel/vulnerabilities/id/9890c852-a38d-4429-bd75-751bd0f986fc?source=api-prod
- 2023-01-20 CRITICAL: Unauthenticated Local File Inclusion (up to 4.1.7.3.2). CVE-2022-47615, https://www.wordfence.com/threat-intel/vulnerabilities/id/f3fe07df-3589-4767-a81d-a6b72c5ab1a8?source=api-prod
- 2022-12-20 HIGH: Authenticated (Subscriber+) SQL Injection (up to 4.1.7.3.2). CVE-2022-45820, https://www.wordfence.com/threat-intel/vulnerabilities/id/34110479-2581-4710-82ff-1d53535d83e1?source=api-prod
- 2022-10-03 CRITICAL: Unauthenticated PHP Object Injection (up to 4.1.7.1). CVE-2022-3360, https://www.wordfence.com/threat-intel/vulnerabilities/id/fa7e74ee-fd66-41e2-babd-06bdfb32d013?source=api-prod
- 2022-07-05 MEDIUM: Reflected Cross-Site Scripting (up to 4.1.6.7). WF-d7bee25e-7574-4d3d-ad58-9b30d99de525, https://www.wordfence.com/threat-intel/vulnerabilities/id/d7bee25e-7574-4d3d-ad58-9b30d99de525?source=api-prod
- 2022-06-14 MEDIUM: Reflected Cross-Site Scripting (up to 4.1.6.5). WF-ca203777-84ea-47ab-bafc-f2cc8f778fcd, https://www.wordfence.com/threat-intel/vulnerabilities/id/ca203777-84ea-47ab-bafc-f2cc8f778fcd?source=api-prod
- 2022-03-16 MEDIUM: Reflected Cross-Site Scripting (before 4.1.6). CVE-2022-0271, https://www.wordfence.com/threat-intel/vulnerabilities/id/782e30a7-6813-47b4-b447-d5f03dcb9dc4?source=api-prod
- 2022-01-26 MEDIUM: Arbitrary Image Renaming (up to 4.1.4.1). CVE-2022-0377, https://www.wordfence.com/threat-intel/vulnerabilities/id/5200ed9c-83dd-4f07-804c-2519932e5546?source=api-prod
- 2021-11-09 CRITICAL: Authenticated SQL Injection (before 4.1.4). CVE-2021-24951, https://www.wordfence.com/threat-intel/vulnerabilities/id/4122a963-b8e2-448a-b268-3192613fa3df?source=api-prod
- 2021-10-18 MEDIUM: Stored Cross-Site Scripting via $custom_profile (up to 4.1.3.1). CVE-2021-39348, https://www.wordfence.com/threat-intel/vulnerabilities/id/5d652b50-9c9c-4418-bd6b-ae862a1c8786?source=api-prod
- 2021-09-20 MEDIUM: Authenticated Stored Cross-Site Scripting (up to 4.1.3). CVE-2021-24702, https://www.wordfence.com/threat-intel/vulnerabilities/id/4489d26b-dcdc-475c-b1e1-3626cc75ae75?source=api-prod
- 2021-07-19 HIGH: SQL Injection (up to 3.2.6.7). CVE-2020-6010, https://www.wordfence.com/threat-intel/vulnerabilities/id/1d79432d-7977-4279-ac69-8e9db682800e?source=api-prod
- 2020-10-05 HIGH: SQL Injection (up to 3.2.7.2). WF-9f9e5212-caed-46db-bbf2-81c4df88439f, https://www.wordfence.com/threat-intel/vulnerabilities/id/9f9e5212-caed-46db-bbf2-81c4df88439f?source=api-prod
- 2020-09-08 MEDIUM: Reflected Cross-Site Scripting (before 3.2.7.3). WF-bc91449a-7013-430d-bf7c-70175ea45114, https://www.wordfence.com/threat-intel/vulnerabilities/id/bc91449a-7013-430d-bf7c-70175ea45114?source=api-prod
- 2020-04-20 HIGH: Privilege Escalation via accept-to-be-teacher action parameter (up to 3.2.6.8). CVE-2020-11511, https://www.wordfence.com/threat-intel/vulnerabilities/id/91f13d74-0ad9-4790-a534-e8ff1655f06f?source=api-prod
- 2020-04-19 HIGH: Authenticated Page Creation and Status Modification (up to 3.2.6.8). CVE-2020-11510, https://www.wordfence.com/threat-intel/vulnerabilities/id/6a639d27-8704-4841-b2b5-6afbf342a0ff?source=api-prod
- 2020-03-16 HIGH: Privilege Escalation (up to 3.2.6.6). CVE-2020-7916, https://www.wordfence.com/threat-intel/vulnerabilities/id/822b5a6b-0be6-4511-bf5d-c32574f27865?source=api-prod
- 2018-11-09 HIGH: Authenticated SQL Injection (up to 3.0.12). CVE-2018-16175, https://www.wordfence.com/threat-intel/vulnerabilities/id/ba16b100-6ee7-46ec-8868-4467a29048ad?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=learnpress · HTML: https://todaywp.com/plugins/learnpress