Wordpress Learning Management System vulnerabilities

19 known vulnerabilities in Wordpress Learning Management System from VibeThemes. 19 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

19vulnerabilities

7critical

12high

0exploited

9.0average CVSS score

Latest first

7.1 High severity
WPLMS: Improper Neutralization of Input During Web Page Generation
CVE-2025-53420Oct 22, 2025VibeThemes
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VibeThemes WPLMS wplms_plugin allows Reflected XSS.This issue affects WPLMS: from n/a through <= 1.9.9.8.
7.5 High severity
WPLMS: Missing Authorization
CVE-2025-49925Oct 22, 2025VibeThemes
Missing Authorization vulnerability in VibeThemes WPLMS wplms_plugin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPLMS: from n/a through <= 1.9.9.7.
9.8 Critical severity
WPLMS: Missing Authorization
CVE-2025-58668Sep 22, 2025VibeThemes
Missing Authorization vulnerability in VibeThemes WPLMS wplms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPLMS : from n/a through <= 4.970.
9.3 Critical severity
WPLMS: Path Traversal: '.../...//'
CVE-2024-56045Dec 31, 2024VibeThemes
Path Traversal: '.../...//' vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through < 1.9.9.5.
9.8 Critical severity
WPLMS: Authentication Bypass Using an Alternate Path or Channel
CVE-2024-56044Dec 31, 2024VibeThemes
Authentication Bypass Using an Alternate Path or Channel vulnerability in VibeThemes WPLMS wplms_plugin allows Authentication Bypass.This issue affects WPLMS: from n/a through <= 1.9.9.
9.8 Critical severity
WPLMS: Incorrect Privilege Assignment
CVE-2024-56043Dec 31, 2024VibeThemes
Incorrect Privilege Assignment vulnerability in VibeThemes WPLMS wplms_plugin allows Privilege Escalation.This issue affects WPLMS: from n/a through <= 1.9.9.
9.8 Critical severity
WPLMS: Unrestricted Upload of File with Dangerous Type
CVE-2024-56046Dec 31, 2024VibeThemes
Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through <= 1.9.9.
9.8 Critical severity
WPLMS: Improper Neutralization of Special Elements used in an SQL Command
CVE-2024-56042Dec 31, 2024VibeThemes
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows SQL Injection.This issue affects WPLMS: from n/a through < 1.9.9.5.3.
8.8 High severity
WPLMS: Unrestricted Upload of File with Dangerous Type
CVE-2024-56057Dec 18, 2024VibeThemes
Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through < 1.9.9.5.2.
8.8 High severity
WPLMS: Path Traversal: '.../...//'
CVE-2024-56055Dec 18, 2024VibeThemes
Path Traversal: '.../...//' vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through < 1.9.9.5.2.
8.8 High severity
WPLMS: Unrestricted Upload of File with Dangerous Type
CVE-2024-56054Dec 18, 2024VibeThemes
Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through < 1.9.9.5.2.
8.8 High severity
WPLMS: Improper Neutralization of Special Elements used in an SQL Command
CVE-2024-56053Dec 18, 2024VibeThemes
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows SQL Injection.This issue affects WPLMS: from n/a through < 1.9.9.5.3.
8.8 High severity
WPLMS: Unrestricted Upload of File with Dangerous Type
CVE-2024-56052Dec 18, 2024VibeThemes
Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through < 1.9.9.5.2.
8.8 High severity
WPLMS: Improper Control of Generation of Code
CVE-2024-56051Dec 18, 2024VibeThemes
Improper Control of Generation of Code ('Code Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows Code Injection.This issue affects WPLMS: from n/a through < 1.9.9.5.
8.8 High severity
WPLMS: Unrestricted Upload of File with Dangerous Type
CVE-2024-56050Dec 18, 2024VibeThemes
Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through < 1.9.9.5.3.
8.5 High severity
WPLMS: Path Traversal: '.../...//'
CVE-2024-56049Dec 18, 2024VibeThemes
Path Traversal: '.../...//' vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through < 1.9.9.5.2.
8.8 High severity
WPLMS: Missing Authorization
CVE-2024-56048Dec 18, 2024VibeThemes
Missing Authorization vulnerability in VibeThemes WPLMS wplms_plugin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPLMS: from n/a through <= 1.9.9.
8.8 High severity
WPLMS: Improper Neutralization of Special Elements used in an SQL Command
CVE-2024-56047Dec 18, 2024VibeThemes
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows SQL Injection.This issue affects WPLMS: from n/a through < 1.9.9.5.3.
9.8 Critical severity
WPLMS Learning Management System for…: Improper Limitation of a Pathname to a Restricted Directory
CVE-2024-10470Nov 9, 2024VibeThemesEPSS 34.8%
The WPLMS Learning Management System for WordPress, WordPress LMS theme for WordPress is vulnerable to arbitrary file read and deletion due to insufficient file path validation and permissions checks in the readfile and unlink functions in all versions up to,