LearnPress vulnerabilities
14 known vulnerabilities in LearnPress from ThimPress. 14 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
LearnPress: Missing Authorization
Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.11.
- 7.1 High severity
LearnPress: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress LearnPress allows Reflected XSS. This issue affects LearnPress: from n/a through 4.3.6.
- 7.5 High severity
LearnPress: Missing Authorization
Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through <= 4.2.9.4.
- 7.5 High severity
LearnPress – WordPress LMS Plugin for Create…: Improper Neutralization of Special Elements used in an SQL Command
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_fields' parameter of the /wp-json/lp/v1/courses/archive-course REST API endpoint in all versions up to, and including, 4.2.7 due to insufficient escaping on th
- 7.5 High severity
LearnPress – WordPress LMS Plugin for Create…: Improper Neutralization of Special Elements used in an SQL Command
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_only_fields' parameter of the /wp-json/learnpress/v1/courses REST API endpoint in all versions up to, and including, 4.2.7 due to insufficient escaping on the
- 8.8 High severity
LearnPress – WordPress LMS Plugin for Create…: Improper Control of Filename for Include/Require Statement in PHP Program
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.2.6.8.2 via the 'render_content_block_template' function. This makes it possible for authenticated attackers, with Contribu
- 9.8 Critical severity
LearnPress – WordPress LMS Plugin for Create…: Improper Neutralization of Special Elements used in an SQL Command
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the ‘term_id’ parameter in versions up to, and including, 4.2.6.5 due to insufficient escaping on the user supplied parameter and lack of sufficient prepar
- 8.8 High severity
LearnPress – WordPress LMS Plugin for Create…: Unrestricted Upload of File with Dangerous Type
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_post_materials' function in versions up to, and including, 4.2.6.5. This makes it possible for authenticated att
- 7.1 High severity
LearnPress Export Import: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress LearnPress Export Import allows Reflected XSS.This issue affects LearnPress Export Import: from n/a through 4.0.3.
- 7.6 High severity
LearnPress Export Import: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ThimPress LearnPress Export Import.This issue affects LearnPress Export Import: from n/a through 4.0.3.
- 8.8 High severity
LearnPress – WordPress LMS Plugin for Create…: Cross-Site Request Forgery
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.0.0. This is due to missing or incorrect nonce validation on the filter_users functions. This makes it possible for u
- 9.8 Critical severity
LearnPress – WordPress LMS Plugin for Create…: Improper Neutralization of Special Elements used in a Command
The LearnPress plugin for WordPress is vulnerable to Command Injection in all versions up to, and including, 4.2.5.7 via the get_content function. This is due to the plugin making use of the call_user_func function with user input. This makes it possible for u
- 7.5 High severity
LearnPress – WordPress LMS Plugin for Create…: Improper Neutralization of Special Elements used in an SQL Command
The LearnPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order_by’ parameter in all versions up to, and including, 4.2.5.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the exist
- 8.1 High severity
LearnPress – WordPress LMS Plugin: Deserialization of Untrusted Data
The LearnPress WordPress plugin before 4.1.7.2 unserialises user input in a REST API endpoint available to unauthenticated users, which could lead to PHP Object Injection when a suitable gadget is present, leadint to remote code execution (RCE). To successfull