What’s Vulnerable › Products

thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses vulnerabilities

98 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 50 published in the last 12 months.

Check whether your thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses version is affected

Latest thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses vulnerabilities

• CVE-2026-115598 — WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability (CVSS 5.3)
• CVE-2026-115597 — WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability (CVSS 5.4)
• CVE-2026-113353 — LearnPress before 4.4.10 Missing Authorization via Legacy Editor AJAX Handlers (CVSS 5.4)
• CVE-2026-110363 — WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability (CVSS 5.4)
• CVE-2026-107744 — LearnPress <= 4.4.10 - Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via 'search-authors' AJAX Action (CVSS 6.5)
• CVE-2026-104736 — LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter (CVSS 9.8)
• CVE-2026-109208 — LearnPress <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' Parameters (CVSS 7.2)
• CVE-2026-104670 — WordPress LearnPress plugin <= 4.4.9 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
• CVE-2026-105397 — LearnPress WordPress Plugin through 4.4.9.1 Stored XSS via Quiz Question Hint and Explanation (CVSS 5.4)
• CVE-2026-92538 — LearnPress <= 4.4.7 - Reflected DOM-Based Cross-Site Scripting via 'orderby' Parameter (CVSS 6.1)
• CVE-2026-39717 — WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability (CVSS 4.3)
• CVE-2026-104403 — WordPress LearnPress plugin <= 4.4.9 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.3)
• CVE-2026-93882 — LearnPress <= 4.4.8 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'item_id' Parameter (CVSS 7.5)
• CVE-2026-86446 — LearnPress 4.4.3 - 4.4.6 - Unauthenticated Quiz Answer Disclosure via check-answer REST Endpoint (CVSS 3.7)
• CVE-2026-86449 — LearnPress < 4.4.7 - Unauthenticated Unpublished Course Disclosure via REST API (CVSS 5.3)
• CVE-2026-86448 — LearnPress < 4.4.7 - Unauthenticated Order Data Disclosure via lp_download_order (CVSS 3.7)
• CVE-2026-86447 — LearnPress < 4.4.7 - Unauthenticated Student Enrollment Disclosure via load_content_via_ajax (CVSS 5.3)
• CVE-2026-86445 — LearnPress < 4.4.7 - Unauthenticated Question Bank Disclosure via load_content_via_ajax (CVSS 5.3)
• CVE-2026-86444 — LearnPress < 4.4.7 - Reflected XSS via 'skin' Parameter (CVSS 7.1)
• CVE-2026-12230 — LearnPress <= 4.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'layout_custom_css' (CVSS 6.4)
• CVE-2026-82024 — LearnPress WordPress Plugin < 4.4.6 Stored XSS via Quiz Question Answer Titles (CVSS 5.4)
• CVE-2026-82023 — LearnPress WordPress Plugin < 4.4.6 Broken Object-Level Authorization via Quiz Answer Insert (CVSS 4.3)
• CVE-2026-77823 — LearnPress <= 4.4.4 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter (CVSS 4.9)
• CVE-2026-78125 — LearnPress – Sepay Payment < 4.0.3 - Unauthenticated Order Status Disclosure (CVSS 5.3)
• CVE-2026-75982 — LearnPress <= 4.4.4 - Missing Authorization to Authenticated (Editor+) Limited Option Update via 'field_name' Parameter (CVSS 4.4)