WordPress learnpress has 38 known advisories in the phpwarden feed. Feed 2026.10.28.3, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2024-8522 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_only_fields' parameter of the /wp-json/ | critical | 10.0 | <4.2.7.1 | 4.2.7.1 |
| CVE-2023-6567 | The LearnPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order_by’ parameter in all versions up to, and includ | critical | 9.8 | <4.2.5.8 | 4.2.5.8 |
| CVE-2020-6010 | LearnPress Wordpress plugin version prior and including 3.2.6.7 is vulnerable to SQL Injection | high | 8.8 | <=3.2.6.7 | – |
| CVE-2024-4434 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the ‘term_id’ parameter in versions | critical | 9.8 | <4.2.6.6 | 4.2.6.6 |
| CVE-2024-8529 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_fields' parameter of the /wp-json/lp/v1 | critical | 10.0 | <4.2.7.1 | 4.2.7.1 |
| CVE-2023-6634 | The LearnPress plugin for WordPress is vulnerable to Command Injection in all versions up to, and including, 4.2.5.7 via the get_content fun | high | 8.1 | <=4.2.5.7 | – |
| CVE-2021-39348 | The LearnPress WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping on the $custom_profile parameter f | medium | 5.5 | <=4.1.3.1 | – |
| CVE-2022-47615 | Local File Inclusion vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions. | critical | 9.3 | <4.2.0 | 4.2.0 |
| CVE-2022-45808 | SQL Injection vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions. | critical | 9.9 | <=4.1.7.3.2 | – |
| CVE-2020-11511 | The LearnPress plugin before 3.2.6.9 for WordPress allows remote attackers to escalate the privileges of any user to LP Instructor via the a | high | 8.1 | <3.2.6.9 | 3.2.6.9 |
| CVE-2022-0377 | Users of the LearnPress WordPress plugin before 4.1.5 can upload an image as a profile avatar after the registration. After this process th | medium | 4.3 | <4.1.5 | 4.1.5 |
| CVE-2022-3360 | The LearnPress WordPress plugin before 4.1.7.2 unserialises user input in a REST API endpoint available to unauthenticated users, which coul | high | 8.1 | <4.1.7.2 | 4.1.7.2 |
| CVE-2022-0271 | The LearnPress WordPress plugin before 4.1.6 does not sanitise and escape the lp-dismiss-notice before outputting it back via the lp_backgro | medium | 6.1 | <4.1.6 | 4.1.6 |
| CVE-2021-24951 | The LearnPress WordPress plugin before 4.1.4 does not sanitise, validate and escape the id parameter before using it in SQL statements when | critical | 9.8 | <4.1.4 | 4.1.4 |
| CVE-2024-11868 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includ | medium | 5.3 | <4.2.7.4 | 4.2.7.4 |
| CVE-2020-7916 | be_teacher in class-lp-admin-ajax.php in the LearnPress plugin 3.2.6.5 and earlier for WordPress allows any registered user to assign itself | medium | 6.5 | <=3.2.6.5 | – |
| CVE-2024-4397 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in th | high | 8.8 | <4.2.6.6 | 4.2.6.6 |
| CVE-2024-5483 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includ | medium | 5.3 | <4.2.6.8.1 | 4.2.6.8.1 |
| CVE-2022-45820 | SQL Injection (SQLi) vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions. | critical | 9.1 | <=4.1.7.3.2 | – |
| CVE-2023-5558 | The LearnPress WordPress plugin before 4.2.5.5 does not sanitise and escape user input before outputting it back in the page, leading to a R | medium | 6.1 | <4.2.5.5 | 4.2.5.5 |
| CVE-2024-6589 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.2.6 | high | 8.8 | <=4.2.6.8.2 | – |
| CVE-2024-4444 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to bypass to user registration in versions up to, and including, 4. | medium | 5.3 | <4.2.6.6 | 4.2.6.6 |
| CVE-2021-24702 | The LearnPress WordPress plugin before 4.1.3.1 does not properly sanitize or escape various inputs within course settings, which could allow | medium | 4.8 | <4.1.3.1 | 4.1.3.1 |
| CVE-2024-7548 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'order' parameter in all versio | high | 8.8 | <4.2.6.9.4 | 4.2.6.9.4 |
| CVE-2024-6088 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized user registration due to a missing capability check | medium | 5.3 | <4.2.6.8.2 | 4.2.6.8.2 |
| CVE-2024-10010 | The LearnPress WordPress plugin before 4.2.7.2 does not sanitise and escape some of its settings, which could allow high privilege users su | medium | 4.8 | <4.2.7.2 | 4.2.7.2 |
| CVE-2024-1463 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Course, Lesson, and Quiz tit | medium | 4.4 | <4.2.6.4 | 4.2.6.4 |
| CVE-2024-6099 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthenticated bypass to user registration in versions up to, a | medium | 5.3 | <4.2.6.8.2 | 4.2.6.8.2 |
| CVE-2024-1289 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and incl | medium | 6.5 | <4.2.6.4 | 4.2.6.4 |
| CVE-2024-9881 | The LearnPress WordPress plugin before 4.2.7.2 does not sanitise and escape some of its settings, which could allow high privilege users su | medium | 4.8 | <4.2.7.2 | 4.2.7.2 |
| CVE-2024-13128 | The LearnPress WordPress plugin before 4.2.7.5.1 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | <4.2.7.5.1 | 4.2.7.5.1 |
| CVE-2023-6223 | The LearnPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.5.7 via the | medium | 4.3 | <=4.2.5.7 | – |
| CVE-2024-4277 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘layout_html’ parameter in a | medium | 6.4 | <4.2.6.6 | 4.2.6.6 |
| CVE-2024-13127 | The LearnPress WordPress plugin before 4.2.7.5.1 does not sanitise and escape some of its settings, which could allow high privilege users | medium | 4.8 | <4.2.7.5.1 | 4.2.7.5.1 |
| CVE-2024-3560 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the _id value in all versions up | medium | 6.4 | <4.2.6.5 | 4.2.6.5 |
| CVE-2024-13599 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including | medium | 6.4 | <4.2.7.5.1 | 4.2.7.5.1 |
| CVE-2024-4971 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in all ver | medium | 6.4 | <4.2.6.7 | 4.2.6.7 |
| CVE-2024-2115 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, | high | 8.8 | <4.0.1 | 4.0.1 |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked