LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
learnpress · плагин
Известные уязвимости для LearnPress – WordPress LMS Plugin for Create and Sell Online Courses. Узнайте за секунды, какая версия работает на вашем сайте, с WP Lens.
61 известных уязвимостей
6 критичных · 12 с публичным эксплойтом · последняя 1 окт. 2026 г.
Уязвимости
- Критич. 9.8
WordPress LearnPress plugin <= 4.2.3 - Unauthenticated Broken Access Control vulnerability
- Критич. 9.8
LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Time-Based SQL Injection
- Критич. 9.8
LearnPress <= 4.2.5.7 - Command Injection
- Критич. 9.8
WordPress LearnPress Plugin <= 4.1.7.3.2 is vulnerable to Local File Inclusion
- Критич. 9.8
WordPress LearnPress Plugin <= 4.1.7.3.2 is vulnerable to SQL Injection
- Критич. 9.1
LearnPress <= 4.3.2.8 - Missing Authorization to Unauthenticated Arbitrary Quiz Answer Deletion
- Высокий 8.8
WordPress LearnPress plugin <= 4.2.6.8.2 - Cross Site Request Forgery (CSRF) vulnerability
- Высокий 8.8
LearnPress <= 4.2.6.8.2 - Authenticated (Contributor+) Local File Inclusion
- Высокий 8.8
WordPress LearnPress plugin <= 4.2.3 - Authenticated Broken Access Control vulnerability
- Высокий 8.8
LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Authenticated (Instructor+) Arbitrary File Upload
- Высокий 8.8
LearnPress – WordPress LMS Plugin <= 4.0.0 - Cross-Site Request Forgery to Privilege Escalation
- Высокий 8.8
WordPress LearnPress Plugin <= 4.1.7.3.2 is vulnerable to SQL Injection
- Высокий 8.8
LearnPress Wordpress plugin version prior and including 3.2.6.7 is vulnerable to SQL Injection
- Высокий 8.1
The LearnPress plugin before 3.2.6.9 for WordPress allows remote attackers to escalate the privileges of any user to LP Instructor via the a
- Высокий 7.5
LearnPress <= 4.4.8 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'item_id' Parameter
- Высокий 7.5
LearnPress <= 4.4.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure via /lp/v1/users/check-answer and /start-quiz REST Endpoints
- Высокий 7.5
WordPress LearnPress plugin <= 4.2.9.4 - Broken Access Control vulnerability
- Высокий 7.5
LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_fields'
- Высокий 7.5
LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_only_fields'
- Высокий 7.5
LearnPress <= 4.2.5.7 - Unauthenticated SQL Injection via order_by
- Высокий 7.2
SQL injection vulnerability in the LearnPress prior to version 3.1.0 allows attacker with administrator rights to execute arbitrary SQL comm
- Высокий 7.1
WordPress LearnPress plugin <= 4.3.6 - Reflected Cross Site Scripting (XSS) vulnerability
- Средний 6.5
LearnPress <= 4.3.9.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'userId' Parameter
- Средний 6.5
WordPress LearnPress plugin <= 4.2.9.4 - Cross Site Scripting (XSS) vulnerability
- Средний 6.5
LearnPress – WordPress LMS Plugin <= 4.2.9.3 - Missing Authorization to Unauthenticated Database Table Manipulation
- Средний 6.5
WordPress LearnPress plugin <= 4.2.6.8.2 - Insecure Direct Object References (IDOR) vulnerability
- Средний 6.5
LearnPress – WordPress LMS Plugin <= 4.2.6.9.3 - Authenticated (Contributor+) SQL Injection via order Parameter
- Средний 6.5
LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Bypass to User Registration
- Средний 6.5
be_teacher in class-lp-admin-ajax.php in the LearnPress plugin 3.2.6.5 and earlier for WordPress allows any registered user to assign itself
- Средний 6.4
LearnPress <= 4.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'layout_custom_css'
- Средний 6.4
LearnPress <= 4.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class_wrapper_form' Shortcode Attribute
- Средний 6.4
LearnPress <= 4.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'skin' Shortcode Attribute
- Средний 6.1
Open redirect vulnerability in LearnPress prior to version 3.1.0 allows remote attackers to redirect users to arbitrary web sites and conduc
- Средний 6.1
Cross-site scripting vulnerability in LearnPress prior to version 3.1.0 allows remote attackers to inject arbitrary web script or HTML via u
- Средний 5.4
LearnPress – WordPress LMS Plugin <= 4.3.2.2 - Insecure Direct Object Reference to Authenticated (Instructor+) Teacher Material Deletion
- Средний 5.4
LearnPress – WordPress LMS Plugin <= 4.2.7.5 - Authenticated (LP Instructor+) Stored Cross-Site Scripting via Lesson Name
- Средний 5.4
LearnPress – WordPress LMS Plugin <= 4.2.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
- Средний 5.4
LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via layout_html Parameter
- Средний 5.4
LearnPress – WordPress LMS Plugin <= 4.2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Средний 5.4
LearnPress <= 4.2.6.3 - Insecure Direct Object Reference
- Средний 5.3
CVE-2026-82023→ 4.4.6
LearnPress WordPress Plugin < 4.4.6 Broken Object-Level Authorization via Quiz Answer Insert
- Средний 5.3
LearnPress <= 4.3.6 - Unauthenticated Sensitive Information Exposure via 'c_status' and 'return_type' Parameters
- Средний 5.3
LearnPress – WordPress LMS Plugin <= 4.3.2.4 - Missing Authorization to Unauthenticated Sensitive User Information Disclosure via REST API
- Средний 5.3
LearnPress – WordPress LMS Plugin <= 4.3.2 - Missing Authentication to Unauthenticated Course Modification
- Средний 5.3
LearnPress – WordPress LMS Plugin <= 4.3.1 - Missing Authorization to Unauthenticated Orders Statistics Exposure
- Средний 5.3
LearnPress – WordPress LMS Plugin <= 4.2.9.4 - Missing Authorization to Unauthenticated Arbitrary Callback Execution to Information Exposure
- Средний 5.3
WordPress LearnPress plugin <= 4.2.7.5 - Broken Access Control vulnerability
- Средний 5.3
LearnPress – WordPress LMS Plugin <= 4.2.7.3 - Course Material Sensitive Information Exposure via REST API
- Средний 5.3
LearnPress – WordPress LMS Plugin <= 4.2.6.8.1 - Unauthenticated Bypass to User Registration
- Средний 5.3
LearnPress – WordPress LMS Plugin <= 4.2.6.8.1 - Missing Authorization to Unauthenticated User Registration Bypass
- Средний 5.3
LearnPress – WordPress LMS Plugin <= 4.2.6.8 - Basic Information Disclosure via JSON API
- Средний 5.1
CVE-2026-82024→ 4.4.6
LearnPress WordPress Plugin < 4.4.6 Stored XSS via Quiz Question Answer Titles
- Средний 4.9
LearnPress <= 4.4.4 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
- Средний 4.8
LearnPress <= 4.2.6.3 - Authenticated(LP Instructor+) Stored Cross-Site Scripting
- Средний 4.8
LearnPress – WordPress LMS Plugin <= 4.1.3.1 Authenticated Stored Cross-Site Scripting
- Средний 4.7
WordPress Learnpress plugin <= 4.2.7.1 - Open Redirection vulnerability
- Средний 4.4
LearnPress <= 4.4.4 - Missing Authorization to Authenticated (Editor+) Limited Option Update via 'field_name' Parameter
- Средний 4.3
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.5 - Authenticated (Subscriber+) Payment Bypass to Free Course Enrollment via 'quanti
- Средний 4.3
LearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Answer Deletion
- Средний 4.3
LearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Notification Triggering
- Средний 4.3
LearnPress <= 4.2.5.7 - Insecure Direct Object Reference to Information Disclosure