CVE Tools
Track your stack

Learnpress – WordPress Lms Plugin For Create and Sell Online Courses

45 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Learnpress – WordPress Lms Plugin For Create and Sell Online Courses, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.

Learnpress – WordPress Lms Plugin For Create and Sell Online Courses CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Learnpress – WordPress Lms Plugin For Create and Sell Online Courses CVEs per month
MonthCVEs
2024-110
2024-121
2025-011
2025-020
2025-030
2025-040
2025-050
2025-060
2025-070
2025-080
2025-090
2025-101
2025-111
2025-122
2026-013
2026-020
2026-032
2026-042
2026-051
2026-061
2026-073
2026-081
2026-092
2026-105

Severity

How the 45 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical613%
  • High818%
  • Medium3169%

Latest CVEs

The 15 most recently published vulnerabilities affecting Learnpress – WordPress Lms Plugin For Create and Sell Online Courses.

  1. CVE-2026-107744LearnPress <= 4.4.10 - Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via 'search-authors' AJAX Action6.5
  2. CVE-2026-104736LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter9.8
  3. CVE-2026-109208LearnPress <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' Parameters7.2
  4. CVE-2026-92538LearnPress <= 4.4.7 - Reflected DOM-Based Cross-Site Scripting via 'orderby' Parameter6.1
  5. CVE-2026-93882LearnPress <= 4.4.8 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'item_id' Parameter7.5
  6. CVE-2026-12230LearnPress <= 4.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'layout_custom_css'6.4
  7. CVE-2026-77823LearnPress <= 4.4.4 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter4.9
  8. CVE-2026-75982LearnPress <= 4.4.4 - Missing Authorization to Authenticated (Editor+) Limited Option Update via 'field_name' Parameter4.4
  9. CVE-2026-13765LearnPress <= 4.4.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure via /lp/v1/users/check-answer and /start-quiz REST Endpoints7.5
  10. CVE-2026-12732LearnPress <= 4.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class_wrapper_form' Shortcode Attribute6.4
  11. CVE-2026-11988LearnPress <= 4.3.9.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'userId' Parameter6.5
  12. CVE-2026-8502LearnPress <= 4.3.6 - Unauthenticated Sensitive Information Exposure via 'c_status' and 'return_type' Parameters5.3
  13. CVE-2026-7648LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.5 - Authenticated (Subscriber+) Payment Bypass to Free Course Enrollment via 'quantity' Parameter4.3
  14. CVE-2026-4365LearnPress <= 4.3.2.8 - Missing Authorization to Unauthenticated Arbitrary Quiz Answer Deletion9.1
  15. CVE-2026-4333LearnPress <= 4.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'skin' Shortcode Attribute6.4

Product grouping is registry-driven, with AI assist and human review. How it works