Skip to content
Noroxi

WPLMS

wplms_plugin · plugin

Known security vulnerabilities for WPLMS. Find out in seconds which version runs on your site with WP Lens.

19 known vulnerabilities

5 critical · 8 exploitable without logging in · latest Jan 22, 2026

Vulnerabilities

  • CVE-2024-56044unauthenticated≤ 1.9.9

    WordPress WPLMS plugin <= 1.9.9 - Unauthenticated Arbitrary User Token Generation vulnerability

    Critical 9.8

  • CVE-2024-56043unauthenticated≤ 1.9.9

    WordPress WPLMS plugin <= 1.9.9 - Unauthenticated Privilege Escalation vulnerability

    Critical 9.8

  • CVE-2024-56046unauthenticated≤ 1.9.9

    WordPress WPLMS plugin <= 1.9.9 - Unauthenticated Arbitrary File Upload vulnerability

    Critical 9.8

  • CVE-2024-56042unauthenticated≤ 1.9.9.5.3

    WordPress WPLMS plugin < 1.9.9.5.3 - Unauthenticated SQL Injection vulnerability

    Critical 9.8

  • CVE-2024-56045unauthenticated≤ 1.9.9.5

    WordPress WPLMS plugin < 1.9.9.5 - Unauthenticated Arbitrary Directory Deletion vulnerability

    Critical 9.3

  • CVE-2024-56057login required≤ 1.9.9.5.2

    WordPress WPLMS plugin < 1.9.9.5.2 - Arbitrary File Upload vulnerability

    High 8.8

  • CVE-2024-56055login required≤ 1.9.9.5.2

    WordPress WPLMS plugin < 1.9.9.5.2 - Arbitrary Directory Deletion vulnerability

    High 8.8

  • CVE-2024-56052login required≤ 1.9.9.5.2

    WordPress WPLMS plugin < 1.9.9.5.2 - Student+ Arbitrary File Upload vulnerability

    High 8.8

  • CVE-2024-56051login required≤ 1.9.9.5

    WordPress WPLMS plugin < 1.9.9.5 - Student+ Remote Code Execution (RCE) vulnerability

    High 8.8

  • CVE-2024-56050subscriber+≤ 1.9.9.5.3

    WordPress WPLMS plugin < 1.9.9.5.3 - Subscriber+ Arbitrary File Upload vulnerability

    High 8.8

  • CVE-2024-56048login required≤ 1.9.9

    WordPress WPLMS plugin <= 1.9.9 - Arbitrary Option Update to Privilege Escalation vulnerability

    High 8.8

  • CVE-2024-56047subscriber+≤ 1.9.9.5.3

    WordPress WPLMS plugin < 1.9.9.5.3 - Subscriber+ SQL Injection vulnerability

    High 8.8

  • CVE-2024-56054high privilege≤ 1.9.9.5.2

    WordPress WPLMS plugin < 1.9.9.5.2 - Instructor+ Arbitrary File Upload vulnerability

    High 8.8

  • CVE-2024-56053high privilege≤ 1.9.9.5.3

    WordPress WPLMS plugin < 1.9.9.5.3 - Instructor+ SQL Injection vulnerability

    High 8.8

  • CVE-2025-69097unauthenticated≤ 1.9.9.5.4

    WordPress WPLMS plugin <= 1.9.9.5.4 - Arbitrary File Deletion vulnerability

    High 8.6

  • CVE-2024-56049subscriber+≤ 1.9.9.5.2

    WordPress WPLMS plugin < 1.9.9.5.2 - Subscriber+ Arbitrary File Deletion vulnerability

    High 8.5

  • CVE-2025-49925unauthenticated≤ 1.9.9.7

    WordPress WPLMS plugin <= 1.9.9.7 - Broken Access Control vulnerability

    High 7.5

  • CVE-2025-53420unauthenticated · needs a click≤ 1.9.9.8

    WordPress WPLMS plugin <= 1.9.9.8 - Cross Site Scripting (XSS) vulnerability

    High 7.1

  • CVE-2025-63035login required≤ 1.9.9.5.4

    WordPress WPLMS plugin <= 1.9.9.5.4 - Cross Site Scripting (XSS) vulnerability

    Medium 6.5

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory