PLUGIN SECURITY
Is Learnpress safe?
A WordPress LMS Plugin to create WordPress Learning Management System. Turn your WordPress to LMS WordPress Website with Courses, Lessons, Quizzes &am …
What this plugin does
- Slug:
learnpress - Author: ThimPress
- 70000+ active installs
- 86/100 rating (597 reviews on wordpress.org)
- 6589199 all-time downloads
- On WordPress.org since 2015-06-07
courseeducationelearninglearning management systemlms
Maintenance status
- Last updated: 2026-10-30 10:41am GMT
- Tested up to WordPress: 7.1.4
- Requires PHP: 7.4+
- Max supported PHP (analyzed): <8.0
Known vulnerabilities
98 known CVEs on file for Learnpress.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-115598 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.4.12 | — | Medium 5.3 | < 4.4.12 | 4.4.12 | 2026-10-26 | — |
| CVE-2026-115597 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.4.12 | — | Medium 5.4 | < 4.4.12 | 4.4.12 | 2026-10-26 | — |
| CVE-2026-115599 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.4.12 | — | High 7.5 | < 4.4.12 | 4.4.12 | 2026-10-26 | — |
| CVE-2026-113353 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.4.10 | — | Medium 5.4 | < 4.4.10 | 4.4.10 | 2026-10-20 | — |
| CVE-2026-110363 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.4.11 | — | Medium 5.4 | < 4.4.11 | 4.4.11 | 2026-10-19 | — |
| CVE-2026-42690 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.4.11 | Missing Authorization | Medium 5.4 | < 4.4.11 | 4.4.11 | 2026-10-19 | — |
| CVE-2026-107744 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.4.11 | Missing Authorization | Medium 6.5 | < 4.4.11 | 4.4.11 | 2026-10-16 | — |
| CVE-2026-104736 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.4.11 | Deserialization of Untrusted Data | Critical 9.8 | < 4.4.11 | 4.4.11 | 2026-10-16 | — |
+ 110 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-109208 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.4.11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.2 | < 4.4.11 | 4.4.11 | 2026-10-16 | — |
| — | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] <= 4.4.9.1 (unfixed) | — | Medium 5.4 | < 4.4.9.1 | 4.4.9.1 | 2026-10-05 | — |
| CVE-2026-104670 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.4.9.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 4.4.9.1 | 4.4.9.1 | 2026-10-05 | — |
| CVE-2026-104403 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.4.9.1 | Authorization Bypass Through User-Controlled Key | Medium 5.3 | < 4.4.9.1 | 4.4.9.1 | 2026-10-02 | — |
| — | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.4.11 | — | Medium 4.3 | < 4.4.11 | 4.4.11 | 2026-10-02 | — |
| CVE-2026-92538 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.4.8 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 4.4.8 | 4.4.8 | 2026-09-30 | — |
| CVE-2026-86444 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.4.7 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Unknown | < 4.4.7 | 4.4.7 | 2026-09-15 | — |
| CVE-2026-86449 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.4.7 | Exposure of Sensitive Information to an Unauthorized Actor | Unknown | < 4.4.7 | 4.4.7 | 2026-09-15 | — |
| CVE-2026-86448 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.4.7 | Exposure of Sensitive Information to an Unauthorized Actor | Unknown | < 4.4.7 | 4.4.7 | 2026-09-15 | — |
| CVE-2026-86447 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.4.7 | Exposure of Sensitive Information to an Unauthorized Actor | Unknown | < 4.4.7 | 4.4.7 | 2026-09-15 | — |
| CVE-2026-86445 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.4.7 | Exposure of Sensitive Information to an Unauthorized Actor | Unknown | < 4.4.7 | 4.4.7 | 2026-09-15 | — |
| CVE-2026-93882 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.4.9 | Authorization Bypass Through User-Controlled Key | High 7.5 | < 4.4.9 | 4.4.9 | 2026-09-15 | — |
| CVE-2026-86446 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] >= 4.4.3 - < 4.4.7 | Exposure of Sensitive Information to an Unauthorized Actor | Unknown | 4.4.3–4.4.7 | 4.4.7 | 2026-09-14 | — |
| CVE-2026-82024 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.4.6 | — | Medium 5.4 | < 4.4.6 | 4.4.6 | 2026-09-03 | — |
| CVE-2026-82023 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.4.6 | — | Medium 4.3 | < 4.4.6 | 4.4.6 | 2026-09-03 | — |
| CVE-2026-12230 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.4.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 4.4.0 | 4.4.0 | 2026-08-31 | — |
| — | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.4.5 | Missing Authorization | Medium 4.4 | < 4.4.5 | 4.4.5 | 2026-08-25 | — |
| CVE-2026-77823 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.4.5 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Medium 4.9 | < 4.4.5 | 4.4.5 | 2026-08-24 | — |
| CVE-2026-12976 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.4.4 | Exposure of Sensitive Information to an Unauthorized Actor | Unknown | < 4.4.4 | 4.4.4 | 2026-08-12 | — |
| CVE-2026-12971 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.4.4 | Server-Side Request Forgery (SSRF) | Unknown | < 4.4.4 | 4.4.4 | 2026-08-10 | — |
| CVE-2026-11988 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.4.0 | Authorization Bypass Through User-Controlled Key | Medium 6.5 | < 4.4.0 | 4.4.0 | 2026-06-30 | — |
| CVE-2026-12732 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.4.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 4.4.1 | 4.4.1 | 2026-06-30 | — |
| CVE-2026-13765 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.4.2 | Missing Authorization | High 7.5 | < 4.4.2 | 4.4.2 | 2026-06-30 | — |
| CVE-2026-12970 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.4.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Unknown | < 4.4.1 | 4.4.1 | 2026-06-29 | — |
| CVE-2026-8383 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.3.7 | Missing Authorization | Medium 5.3 | < 4.3.7 | 4.3.7 | 2026-06-17 | — |
| CVE-2026-8502 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.3.7 | Missing Authorization | Medium 5.3 | < 4.3.7 | 4.3.7 | 2026-06-05 | — |
| CVE-2026-48865 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.3.7 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 4.3.7 | 4.3.7 | 2026-06-01 | — |
| CVE-2026-7648 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.3.6 | Authorization Bypass Through User-Controlled Key | Medium 4.3 | < 4.3.6 | 4.3.6 | 2026-05-13 | — |
| CVE-2025-14798 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.3.2.5 | Missing Authorization | Medium 5.3 | < 4.3.2.5 | 4.3.2.5 | 2026-01-19 | — |
| CVE-2025-14802 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.3.2.2 | Authorization Bypass Through User-Controlled Key | Medium 5.4 | < 4.3.2.2 | 4.3.2.2 | 2026-01-06 | — |
| CVE-2025-13964 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.3.2.1 | Missing Authorization | Medium 5.3 | < 4.3.2.1 | 4.3.2.1 | 2026-01-05 | — |
| CVE-2025-14387 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.3.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 4.3.2 | 4.3.2 | 2025-12-15 | — |
| CVE-2025-13956 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.3.2 | Missing Authorization | Medium 5.3 | < 4.3.2 | 4.3.2 | 2025-12-15 | — |
| CVE-2025-66054 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.3.0 | Missing Authorization | High 7.5 | < 4.3.0 | 4.3.0 | 2025-11-30 | — |
| CVE-2025-11368 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.3.0 | Exposure of Sensitive Information to an Unauthorized Actor | Medium 5.3 | < 4.3.0 | 4.3.0 | 2025-11-20 | — |
| CVE-2025-67536 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.3.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.5 | < 4.3.0 | 4.3.0 | 2025-11-06 | — |
| CVE-2025-11372 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.2.9.4 | Missing Authorization | Medium 6.5 | < 4.2.9.4 | 4.2.9.4 | 2025-10-17 | — |
| CVE-2025-22739 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.2.7.6 | Missing Authorization | Medium 5.3 | < 4.2.7.6 | 4.2.7.6 | 2025-03-27 | — |
| CVE-2024-13127 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.2.7.5.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 4.2.7.5.1 | 4.2.7.5.1 | 2025-01-29 | — |
| CVE-2024-13128 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.2.7.5.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 4.2.7.5.1 | 4.2.7.5.1 | 2025-01-29 | — |
| CVE-2024-13599 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.2.7.5.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 4.2.7.5.1 | 4.2.7.5.1 | 2025-01-24 | — |
| CVE-2025-24740 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.2.7.2 | URL Redirection to Untrusted Site ('Open Redirect') | Medium 4.7 | < 4.2.7.2 | 4.2.7.2 | 2025-01-24 | — |
| CVE-2024-11868 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.2.7.4 | Improper Access Control | Medium 5.3 | < 4.2.7.4 | 4.2.7.4 | 2024-12-09 | — |
| CVE-2024-9881 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.2.7.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 4.2.7.2 | 4.2.7.2 | 2024-11-21 | — |
| CVE-2024-10010 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.2.7.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 4.2.7.2 | 4.2.7.2 | 2024-11-21 | — |
| CVE-2024-8522 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.2.7.1 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 7.5 | < 4.2.7.1 | 4.2.7.1 | 2024-09-11 | — |
| CVE-2024-8529 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.2.7.1 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 7.5 | < 4.2.7.1 | 4.2.7.1 | 2024-09-11 | — |
| CVE-2024-7548 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.2.6.9.4 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Medium 6.5 | < 4.2.6.9.4 | 4.2.6.9.4 | 2024-08-07 | — |
| CVE-2024-39641 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.2.6.9 | Cross-Site Request Forgery (CSRF) | High 8.8 | < 4.2.6.9 | 4.2.6.9 | 2024-08-01 | — |
| CVE-2024-39642 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.2.6.9 | Authorization Bypass Through User-Controlled Key | Medium 6.5 | < 4.2.6.9 | 4.2.6.9 | 2024-08-01 | — |
| CVE-2024-6589 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.2.6.9 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | High 8.8 | < 4.2.6.9 | 4.2.6.9 | 2024-07-24 | — |
| CVE-2024-6088 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.2.6.8.2 | Missing Authorization | Medium 5.3 | < 4.2.6.8.2 | 4.2.6.8.2 | 2024-07-01 | — |
| CVE-2024-6099 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.2.6.8.2 | Unprotected Alternate Channel | Medium 5.3 | < 4.2.6.8.2 | 4.2.6.8.2 | 2024-07-01 | — |
| CVE-2024-5483 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.2.6.8.1 | Exposure of Sensitive Information to an Unauthorized Actor | Medium 5.3 | < 4.2.6.8.1 | 4.2.6.8.1 | 2024-06-04 | — |
| CVE-2024-4971 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.2.6.7 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 4.2.6.7 | 4.2.6.7 | 2024-05-21 | — |
| CVE-2024-4397 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.2.6.6 | Unrestricted Upload of File with Dangerous Type | High 8.8 | < 4.2.6.6 | 4.2.6.6 | 2024-05-09 | — |
| CVE-2024-4277 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.2.6.6 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 4.2.6.6 | 4.2.6.6 | 2024-05-09 | — |
| CVE-2024-4434 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.2.6.6 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Critical 9.8 | < 4.2.6.6 | 4.2.6.6 | 2024-05-09 | — |
| CVE-2024-4444 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.2.6.6 | Unprotected Alternate Channel | Medium 6.5 | < 4.2.6.6 | 4.2.6.6 | 2024-05-09 | — |
| CVE-2024-3560 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.2.6.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 4.2.6.5 | 4.2.6.5 | 2024-04-18 | — |
| CVE-2024-2115 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.0.1 | Cross-Site Request Forgery (CSRF) | High 8.8 | < 4.0.1 | 4.0.1 | 2024-04-04 | — |
| CVE-2024-1289 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.2.6.4 | Improper Authorization | Medium 5.4 | < 4.2.6.4 | 4.2.6.4 | 2024-04-04 | — |
| CVE-2024-1463 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.2.6.4 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 4.2.6.4 | 4.2.6.4 | 2024-04-04 | — |
| CVE-2023-6634 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.2.5.8 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | Critical 9.8 | < 4.2.5.8 | 4.2.5.8 | 2024-01-03 | — |
| CVE-2023-6223 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.2.5.8 | Authorization Bypass Through User-Controlled Key | Medium 4.3 | < 4.2.5.8 | 4.2.5.8 | 2024-01-02 | — |
| CVE-2023-6567 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.2.5.8 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 7.5 | < 4.2.5.8 | 4.2.5.8 | 2024-01-02 | — |
| — | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.2.5.4 | — | Unknown | < 4.2.5.4 | 4.2.5.4 | 2023-11-08 | — |
| CVE-2023-5558 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.2.5.4 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 4.2.5.4 | 4.2.5.4 | 2023-11-07 | — |
| — | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.2.3.1 | — | Unknown | < 4.2.3.1 | 4.2.3.1 | 2023-07-06 | — |
| CVE-2023-36516 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.2.3.1 | Missing Authorization | High 7.6 | < 4.2.3.1 | 4.2.3.1 | 2023-07-04 | — |
| CVE-2023-36515 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.2.3.1 | Missing Authorization | High 7.3 | < 4.2.3.1 | 4.2.3.1 | 2023-07-04 | — |
| CVE-2022-47615 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.2.0 | Unrestricted Upload of File with Dangerous Type | Critical 9.3 | < 4.2.0 | 4.2.0 | 2023-01-20 | — |
| CVE-2022-45808 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.2.0 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Critical 9.9 | < 4.2.0 | 4.2.0 | 2023-01-20 | — |
| CVE-2022-45820 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.2.0 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Critical 9.1 | < 4.2.0 | 4.2.0 | 2022-12-20 | — |
| CVE-2022-3360 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.1.7.2 | Deserialization of Untrusted Data | High 8.1 | < 4.1.7.2 | 4.1.7.2 | 2022-10-03 | — |
| — | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.1.6.8 | — | Unknown | < 4.1.6.8 | 4.1.6.8 | 2022-07-05 | — |
| — | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.1.6.7 | — | Unknown | < 4.1.6.7 | 4.1.6.7 | 2022-06-21 | — |
| — | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.1.6.6 | — | Unknown | < 4.1.6.6 | 4.1.6.6 | 2022-06-14 | — |
| CVE-2022-0271 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.1.6 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 4.1.6 | 4.1.6 | 2022-03-16 | — |
| CVE-2022-0377 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.1.5 | Use of a Broken or Risky Cryptographic Algorithm | Medium 4.3 | < 4.1.5 | 4.1.5 | 2022-01-26 | — |
| CVE-2021-24951 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.1.5 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Critical 9.8 | < 4.1.5 | 4.1.5 | 2021-11-09 | — |
| CVE-2021-39348 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.1.3.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 4.1.3.2 | 4.1.3.2 | 2021-10-18 | — |
| CVE-2021-24702 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.1.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 4.1.5 | 4.1.5 | 2021-09-20 | — |
| — | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 3.2.7.3 | — | Unknown | < 3.2.7.3 | 3.2.7.3 | 2020-10-05 | — |
| — | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 3.2.7.3 | — | Unknown | < 3.2.7.3 | 3.2.7.3 | 2020-09-09 | — |
| — | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 3.2.7.3 | — | Unknown | < 3.2.7.3 | 3.2.7.3 | 2020-09-08 | — |
| CVE-2020-6010 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 3.2.6.8 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 8.8 | < 3.2.6.8 | 3.2.6.8 | 2020-04-29 | — |
| CVE-2020-11511 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 3.2.6.9 | Missing Authorization | High 8.1 | < 3.2.6.9 | 3.2.6.9 | 2020-04-20 | — |
| CVE-2020-7916, CVE-2020-7917 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 3.2.6.8 | Improper Privilege Management | Medium 6.5 | < 3.2.6.8 | 3.2.6.8 | 2020-03-16 | — |
| CVE-2018-16173 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 3.1.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 3.1.0 | 3.1.0 | 2018-11-09 | — |
| CVE-2018-16174 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 3.1.0 | URL Redirection to Untrusted Site ('Open Redirect') | Medium 6.1 | < 3.1.0 | 3.1.0 | 2018-11-09 | — |
| CVE-2018-16175 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 3.1.0 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 7.2 | < 3.1.0 | 3.1.0 | 2018-11-09 | — |
| CVE-2020-11510 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 3.2.6.9 | — | Unknown | < 3.2.6.9 | 3.2.6.9 | 0000-00-00 | — |
| CVE-2020-7917 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 3.2.6.7 | — | Unknown | < 3.2.6.7 | 3.2.6.7 | 0000-00-00 | — |
| — | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.3.4 | — | Unknown | < 4.3.4 | 4.3.4 | 0000-00-00 | — |
| — | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.3.3 | — | Unknown | < 4.3.3 | 4.3.3 | 0000-00-00 | — |
| — | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.3.3 | — | Unknown | < 4.3.3 | 4.3.3 | 0000-00-00 | — |
| — | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.3.3 | — | Unknown | < 4.3.3 | 4.3.3 | 0000-00-00 | — |
| — | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 4.1.6.7 | — | Unknown | < 4.1.6.7 | 4.1.6.7 | — | — |
| — | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses [learnpress] < 3.2.7.3 | — | Unknown | < 3.2.7.3 | 3.2.7.3 | — | — |
| — | LearnPress < 3.2.7.3 - CSRF & XSS | — | Unknown | < 3.2.7.3 | 3.2.7.3 | — | — |
| — | LearnPress < 4.1.6.7 - Reflected Cross-Site Scripting | — | Unknown | < 4.1.6.7 | 4.1.6.7 | — | — |
| CVE-2023-5558 | LearnPress < 4.2.5.5 - Reflected Cross-Site Scripting | — | Unknown | < 4.2.5.5 | 4.2.5.5 | — | — |
| CVE-2026-3226 | LearnPress < 4.3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Notification Triggering | — | Unknown | < 4.3.3 | 4.3.3 | — | — |
| CVE-2026-3225 | LearnPress < 4.3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Answer Deletion | — | Unknown | < 4.3.3 | 4.3.3 | — | — |
| CVE-2026-4333 | LearnPress < 4.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'skin' Shortcode Attribute | — | Unknown | < 4.3.4 | 4.3.4 | — | — |
| CVE-2026-4365 | LearnPress < 4.3.3 - Unauthenticated Arbitrary Quiz Answer Deletion | — | Unknown | < 4.3.3 | 4.3.3 | — | — |
| CVE-2026-75982 | LearnPress < 4.4.5 - Missing Authorization to Authenticated (Editor+) Limited Option Update via 'field_name' Parameter | — | Unknown | < 4.4.5 | 4.4.5 | — | — |
| CVE-2026-39717 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses < 4.4.11 - Missing Authorization | — | Unknown | < 4.4.11 | 4.4.11 | — | — |
| CVE-2026-105397 | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses < 4.4.10 - Authenticated (Instructor+) Stored Cross-Site Scripting | — | Unknown | < 4.4.10 | 4.4.10 | — | — |
How to fix it
Update this plugin to the latest release from wordpress.org — each CVE above lists the exact release that fixed it ("Fixed in") when one is on file.
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- ProfilePress – Paid Membership, Online Courses (LMS), Ecommerce, User Registration & Login Form, User Profile & Restrict Content — 100000+ active installs — 62/100 (938)
- Tutor LMS – eLearning and online course solution — 100000+ active installs — 88/100 (591) — max PHP <8.0
- Interactive Content – H5P — 40000+ active installs — 96/100 (61) — max PHP 8.4
- LearnPress – Course Review — 20000+ active installs — 50/100 (8) — max PHP 8.4
- Uncanny Toolkit for LearnDash — 20000+ active installs — 96/100 (105)
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.