School Management System – WPSchoolPress
wpschoolpress · plugin
Known security vulnerabilities for School Management System – WPSchoolPress. Find out in seconds which version runs on your site with WP Lens.
9 known vulnerabilities
latest Apr 8, 2026
Listed on wordpress.org · latest 2.2.48 · last updated Aug 7, 2026 · 1K+ installs
wordpress.org status checked on Oct 2, 2026
Vulnerabilities
- High 8.8
CVE-2024-9637login required≤ 2.2.10
School Management System – WPSchoolPress <= 2.2.10 - Insecure Direct Object Reference to Authenticated (Teacher+) Account Takeover/Privilege Escalation
- Medium 6.5
CVE-2025-1670login required≤ 2.2.16
School Management System – WPSchoolPress <= 2.2.16 - Authenticated (Parent+) SQL Injection
- Medium 6.5
CVE-2025-1669login required≤ 2.2.17
School Management System – WPSchoolPress <= 2.2.17 - Authenticated (Teacher+) SQL Injection
- Medium 6.5
CVE-2024-12332login required≤ 2.2.14
School Management System – WPSchoolPress <= 2.2.14 - Authenticated (Student/Parent+) SQL Injection
- Medium 6.5
CVE-2023-37887login required≤ 2.2.7
WordPress WPSchoolPress plugin <= 2.2.7 - Broken Access Control vulnerability
- Medium 5.4
CVE-2025-1668login required≤ 2.2.16
School Management System – WPSchoolPress <= 2.2.16 - Missing Authorization to Arbitrary User Deletion
- Medium 4.9
CVE-2026-39631high privilege≤ 2.2.35
WordPress WPSchoolPress plugin <= 2.2.35 - Broken Access Control vulnerability
- Medium 4.9
CVE-2025-11981admin≤ 2.2.23
School Management System – WPSchoolPress <= 2.2.23 - Authenticated (Administrator+) SQL Injection
- Medium 4.3
CVE-2025-1667login required≤ 2.2.16
School Management System – WPSchoolPress <= 2.2.16 - Missing Authorization to Privilege Escalation via Account Takeover
The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).