LearnPress – WordPress LMS Plugin for Create and Sell Online Courses

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   LearnPress – WordPress LMS Plugin for Create and Sell Online Courses

Information

Software Type Plugin
Software Slug learnpress (view on wordpress.org)
Software Status Active
Software Author thimpress
Software Website thimpress.com
Software Downloads 6,480,399
Software Active Installs 70,000
Software Record Last Updated October 10, 2026

Showing 1-20 of 92 Vulnerabilities

Submit a Vulnerability
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.9 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-104670
Oct 5, 2026
Researcher: daroo
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.9.1 - Authenticated (Instructor+) Stored Cross-Site Scripting
6.4
CVE-2026-105397
Oct 5, 2026
Researcher: HunterSploit
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.9.1 - Missing Authorization
4.3
CVE-2026-39717
Oct 2, 2026
Researcher: Ananda Dhakal
LearnPress <= 4.4.7 - Reflected DOM-Based Cross-Site Scripting via 'orderby' Parameter
6.1
CVE-2026-92538
Oct 2, 2026
Researcher: Yuto Hyakumoto
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.9 - Unauthenticated Insecure Direct Object Reference
5.3
CVE-2026-104403
Oct 2, 2026
Researcher: Ananda Dhakal
LearnPress <= 4.4.8 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'item_id' Parameter
7.5
CVE-2026-93882
Sep 30, 2026
Researcher: Khoa Dang
LearnPress 4.4.3 - 4.4.6 - Unauthenticated Information Exposure
5.3
CVE-2026-86446
Sep 15, 2026
Researcher: Nicat Sultanov
LearnPress <= 4.4.6 - Reflected Cross-Site Scripting
6.1
CVE-2026-86444
Sep 14, 2026
Researcher: Karthik Ramakrishnan
LearnPress <= 4.4.6 - Unauthenticated Information Exposure
5.3
CVE-2026-86445
Sep 14, 2026
Researcher: Karthik Ramakrishnan
LearnPress <= 4.4.6 - Unauthenticated Information Exposure
5.3
CVE-2026-86447
Sep 14, 2026
Researcher: vuxvinh
LearnPress <= 4.4.6 - Unauthenticated Information Exposure
5.3
CVE-2026-86448
Sep 14, 2026
Researcher: Artus KG
LearnPress <= 4.4.6 - Unauthenticated Information Exposure
5.3
CVE-2026-86449
Sep 14, 2026
Researcher: Sai Praneeth Koti
LearnPress <= 4.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'layout_custom_css'
6.4
CVE-2026-12230
Sep 7, 2026
Researchers: Muni Nitish Kumar Yaddala (Stranger825), Revanth Matte
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.5 - Missing Authorization
4.3
CVE-2026-82023
Sep 3, 2026
Researcher: Yll Berisha
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.5 - Authenticated (Instructor+) Stored Cross-Site Scripting
6.4
CVE-2026-82024
Sep 3, 2026
Researcher: Yll Berisha
LearnPress <= 4.4.4 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
4.9
CVE-2026-77823
Aug 31, 2026
Researcher: Wordfence PRISM
LearnPress <= 4.4.4 - Missing Authorization to Authenticated (Editor+) Limited Option Update via 'field_name' Parameter
4.4
CVE-2026-75982
Aug 24, 2026
Researcher: Wordfence PRISM
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses < 4.4.4 - Authenticated (Subscriber+) Information Exposure
4.3
CVE-2026-12976
Aug 13, 2026
Researcher: Yaswanth Reddy Sunkara
LearnPress <= 4.4.3 - Authenticated (Instructor+) Server-Side Request Forgery
6.4
CVE-2026-12971
Aug 6, 2026
Researcher: Meher Sudhakar Abbireddi
LearnPress <= 4.4.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure via /lp/v1/users/check-answer and /start-quiz REST Endpoints
7.5
CVE-2026-13765
Jul 16, 2026
Researcher: 이성민
Title Status CVE ID CVSS Researchers Date
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.9 - Unauthenticated Stored Cross-Site Scripting Patched CVE-2026-104670 7.2 daroo October 5, 2026
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.9.1 - Authenticated (Instructor+) Stored Cross-Site Scripting Unpatched CVE-2026-105397 6.4 HunterSploit October 5, 2026
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.9.1 - Missing Authorization Unpatched CVE-2026-39717 4.3 Ananda Dhakal October 2, 2026
LearnPress <= 4.4.7 - Reflected DOM-Based Cross-Site Scripting via 'orderby' Parameter Patched CVE-2026-92538 6.1 Yuto Hyakumoto October 2, 2026
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.9 - Unauthenticated Insecure Direct Object Reference Patched CVE-2026-104403 5.3 Ananda Dhakal October 2, 2026
LearnPress <= 4.4.8 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'item_id' Parameter Patched CVE-2026-93882 7.5 Khoa Dang September 30, 2026
LearnPress 4.4.3 - 4.4.6 - Unauthenticated Information Exposure Patched CVE-2026-86446 5.3 Nicat Sultanov September 15, 2026
LearnPress <= 4.4.6 - Reflected Cross-Site Scripting Patched CVE-2026-86444 6.1 Karthik Ramakrishnan September 14, 2026
LearnPress <= 4.4.6 - Unauthenticated Information Exposure Patched CVE-2026-86445 5.3 Karthik Ramakrishnan September 14, 2026
LearnPress <= 4.4.6 - Unauthenticated Information Exposure Patched CVE-2026-86447 5.3 vuxvinh September 14, 2026
LearnPress <= 4.4.6 - Unauthenticated Information Exposure Patched CVE-2026-86448 5.3 Artus KG September 14, 2026
LearnPress <= 4.4.6 - Unauthenticated Information Exposure Patched CVE-2026-86449 5.3 Sai Praneeth Koti September 14, 2026
LearnPress <= 4.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'layout_custom_css' Patched CVE-2026-12230 6.4 Muni Nitish Kumar Yaddala (Stranger825), Revanth Matte September 7, 2026
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.5 - Missing Authorization Patched CVE-2026-82023 4.3 Yll Berisha September 3, 2026
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.5 - Authenticated (Instructor+) Stored Cross-Site Scripting Patched CVE-2026-82024 6.4 Yll Berisha September 3, 2026
LearnPress <= 4.4.4 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter Patched CVE-2026-77823 4.9 Wordfence PRISM August 31, 2026
LearnPress <= 4.4.4 - Missing Authorization to Authenticated (Editor+) Limited Option Update via 'field_name' Parameter Patched CVE-2026-75982 4.4 Wordfence PRISM August 24, 2026
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses < 4.4.4 - Authenticated (Subscriber+) Information Exposure Patched CVE-2026-12976 4.3 Yaswanth Reddy Sunkara August 13, 2026
LearnPress <= 4.4.3 - Authenticated (Instructor+) Server-Side Request Forgery Patched CVE-2026-12971 6.4 Meher Sudhakar Abbireddi August 6, 2026
LearnPress <= 4.4.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure via /lp/v1/users/check-answer and /start-quiz REST Endpoints Patched CVE-2026-13765 7.5 이성민 July 16, 2026

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation