WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 29,007 vulnerabilities, 1,391 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 5, 2026.
Showing 1–50 of 81 vulnerabilities matching your filters
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 6.1 Medium | LearnPress | Cross-Site Scripting Reflected DOM-Based Cross-Site Scripting via 'orderby' Parameter No login needed |
≤ 4.4.7 |
CVE-2026-92538 |
Wordfence | |
| 4.3 Medium | LearnPress | Broken Access Control |
≤ 4.4.9.1 |
CVE-2026-39717 |
Patchstack | |
| 5.3 Medium | LearnPress | Broken Access Control Insecure Direct Object References (IDOR) No login needed |
≤ 4.4.9 Fixed in 4.4.9.1 |
CVE-2026-104403 |
Patchstack | |
| 7.5 High | LearnPress | Broken Access Control Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'item_id' Parameter No login needed |
≤ 4.4.8 |
CVE-2026-93882 |
Wordfence | |
| 3.7 Low | LearnPress | Information Disclosure Unauthenticated Quiz Answer Disclosure via check-answer REST Endpoint No login needed |
4.4.3 – < 4.4.7 Fixed in 4.4.7 |
CVE-2026-86446 |
WPScan | |
| 5.3 Medium | LearnPress | Information Disclosure Unauthenticated Unpublished Course Disclosure via REST API No login needed |
4.2.7.1 – < 4.4.7 Fixed in 4.4.7 |
CVE-2026-86449 |
WPScan | |
| 3.7 Low | LearnPress | Information Disclosure Unauthenticated Order Data Disclosure via lp_download_order No login needed |
4.3.2.8 – < 4.4.7 Fixed in 4.4.7 |
CVE-2026-86448 |
WPScan | |
| 5.3 Medium | LearnPress | Information Disclosure Unauthenticated Student Enrollment Disclosure via load_content_via_ajax No login needed |
4.4.6 – < 4.4.7 Fixed in 4.4.7 |
CVE-2026-86447 |
WPScan | |
| 5.3 Medium | LearnPress | Information Disclosure Unauthenticated Question Bank Disclosure via load_content_via_ajax No login needed |
4.2.9 – < 4.4.7 Fixed in 4.4.7 |
CVE-2026-86445 |
WPScan | |
| 7.1 High | LearnPress | Cross-Site Scripting Reflected XSS via 'skin' Parameter No login needed |
4.2.6.4 – < 4.4.7 Fixed in 4.4.7 |
CVE-2026-86444 |
WPScan | |
| 6.4 Medium | LearnPress | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'layout_custom_css' |
≤ 4.3.9.1 |
CVE-2026-12230 |
Wordfence | |
| 5.4 Medium | LearnPress | Cross-Site Scripting LearnPress WordPress Plugin < 4.4.6 Stored XSS via Quiz Question Answer Titles |
< 4.4.6 Fixed in 4.4.6 |
CVE-2026-82024 |
VulnCheck | |
| 4.3 Medium | LearnPress | Broken Access Control LearnPress WordPress Plugin < 4.4.6 Broken Object-Level Authorization via Quiz Answer Insert |
< 4.4.6 Fixed in 4.4.6 |
CVE-2026-82023 |
VulnCheck | |
| 4.9 Medium | LearnPress | SQL Injection Authenticated (Administrator+) SQL Injection via 'orderby' Parameter |
≤ 4.4.4 |
CVE-2026-77823 |
Wordfence | |
| 5.3 Medium | LearnPress – Sepay Payment | Information Disclosure Sepay Payment < 4.0.3 - Unauthenticated Order Status Disclosure No login needed |
< 4.0.3 Fixed in 4.0.3 |
CVE-2026-78125 |
WPScan | |
| 4.4 Medium | LearnPress | Broken Access Control Missing Authorization to Authenticated (Editor+) Limited Option Update via 'field_name' Parameter |
≤ 4.4.4 |
CVE-2026-75982 |
Wordfence | |
| 6.5 Medium | LearnPress | Information Disclosure Subscriber+ Sensitive Information Exposure via AI Assistant |
< 4.4.4 Fixed in 4.4.4 |
CVE-2026-12976 |
WPScan | |
| 2.2 Low | LearnPress | Server-Side Request Forgery Instructor+ Server-Side Request Forgery via openai_apply_image_feature |
< 4.4.4 Fixed in 4.4.4 |
CVE-2026-12971 |
WPScan | |
| 7.1 High | LearnPress | Cross-Site Scripting Reflected XSS via c_search No login needed |
< 4.4.1 Fixed in 4.4.1 |
CVE-2026-12970 |
WPScan | |
| 7.5 High | LearnPress | Broken Access Control Missing Authorization to Unauthenticated Sensitive Information Exposure via /lp/v1/users/check-answer and /start-quiz REST Endpoints No login needed |
≤ 4.4.1 |
CVE-2026-13765 |
Wordfence | |
| 6.4 Medium | LearnPress | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'class_wrapper_form' Shortcode Attribute |
≤ 4.4.0 |
CVE-2026-12732 |
Wordfence | |
| 6.5 Medium | LearnPress | Broken Access Control Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'userId' Parameter |
≤ 4.3.9.1 |
CVE-2026-11988 |
Wordfence | |
| 5.3 Medium | LearnPress | Information Disclosure Unauthenticated Sensitive User Information Disclosure via REST API No login needed |
< 4.3.7 Fixed in 4.3.7 |
CVE-2026-8383 |
WPScan | |
| 5.3 Medium | LearnPress | Information Disclosure Unauthenticated Sensitive Information Exposure via 'c_status' and 'return_type' Parameters No login needed |
≤ 4.3.6 |
CVE-2026-8502 |
Wordfence | |
| 6.6 Medium | LearnPress – Backup & Migration Tool | PHP Object Injection Backup & Migration Tool <= 4.1.4 - Authenticated (Administrator+) PHP Object Injection via WXR XML File Upload |
≤ 4.1.4 |
CVE-2026-7566 |
Wordfence | |
| 4.9 Medium | LearnPress | Path Traversal Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'import-user-file' Parameter |
≤ 4.1.4 |
CVE-2026-7565 |
Wordfence | |
| 7.1 High | LearnPress | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 4.3.6 Fixed in 4.3.7 |
CVE-2026-48865 |
Patchstack | |
| 4.3 Medium | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses | Price Manipulation WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.5 - Authenticated (Subscriber+) Payment Bypass to Free Course Enrollment via 'quantity' Parameter |
≤ 4.3.5 |
CVE-2026-7648 |
Wordfence | |
| 9.1 Critical | LearnPress | Broken Access Control Missing Authorization to Unauthenticated Arbitrary Quiz Answer Deletion No login needed |
≤ 4.3.2.8 |
CVE-2026-4365 |
Wordfence | |
| 6.4 Medium | LearnPress | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'skin' Shortcode Attribute |
≤ 4.3.3 |
CVE-2026-4333 |
Wordfence | |
| 7.5 High | LearnPress – Sepay Payment | Authentication Bypass Sepay Payment plugin <= 4.0.0 - Broken Authentication No login needed |
≤ 4.0.0 Fixed in 4.0.1 |
CVE-2026-25002 |
Patchstack | |
| 4.3 Medium | LearnPress | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Answer Deletion |
≤ 4.3.2.8 |
CVE-2026-3225 |
Wordfence | |
| 4.3 Medium | LearnPress | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Notification Triggering |
≤ 4.3.2.8 |
CVE-2026-3226 |
Wordfence | |
| 4.8 Medium | LearnPress Export Import | Broken Access Control Missing Authentication to Unauthenticated Migrated Course Deletion No login needed |
≤ 4.1.0 |
CVE-2026-1787 |
Wordfence | |
| 6.5 Medium | LearnPress – Course Review | Cross-Site Scripting Course Review plugin <= 4.1.9 - Cross Site Scripting (XSS) |
≤ 4.1.9 Fixed in 4.2.0 |
CVE-2026-24361 |
Patchstack | |
| 5.3 Medium | LearnPress – WordPress LMS | Broken Access Control WordPress LMS Plugin <= 4.3.2.4 - Missing Authorization to Unauthenticated Sensitive User Information Disclosure via REST API No login needed |
≤ 4.3.2.4 |
CVE-2025-14798 |
Wordfence | |
| 5.4 Medium | LearnPress – WordPress LMS | Broken Access Control WordPress LMS Plugin <= 4.3.2.2 - Insecure Direct Object Reference to Authenticated (Instructor+) Teacher Material Deletion |
≤ 4.3.2.1 |
CVE-2025-14802 |
Wordfence | |
| 5.3 Medium | LearnPress – WordPress LMS | Broken Access Control WordPress LMS Plugin <= 4.3.2 - Missing Authentication to Unauthenticated Course Modification No login needed |
≤ 4.3.2 |
CVE-2025-13964 |
Wordfence | |
| 7.5 High | LearnPress | Broken Access Control No login needed |
≤ 4.2.9.4 Fixed in 4.3.0 |
CVE-2025-66054 |
Patchstack | |
| 5.3 Medium | LearnPress – WordPress LMS | Broken Access Control WordPress LMS Plugin <= 4.3.1 - Missing Authorization to Unauthenticated Orders Statistics Exposure No login needed |
≤ 4.3.1 |
CVE-2025-13956 |
Wordfence | |
| 6.4 Medium | LearnPress – WordPress LMS | Cross-Site Scripting WordPress LMS Plugin <= 4.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via get_profile_social |
≤ 4.3.1 |
CVE-2025-14387 |
Wordfence | |
| 6.5 Medium | LearnPress | Cross-Site Scripting |
≤ 4.2.9.4 Fixed in 4.3.0 |
CVE-2025-67536 |
Patchstack | |
| 5.3 Medium | LearnPress – WordPress LMS | Broken Access Control WordPress LMS Plugin <= 4.2.9.4 - Missing Authorization to Unauthenticated Arbitrary Callback Execution to Information Exposure No login needed |
≤ 4.2.9.4 |
CVE-2025-11368 |
Wordfence | |
| 7.5 High | LearnPress Export Import | Local File Inclusion No login needed |
≤ 4.1.2 Fixed in 4.1.3 |
CVE-2025-60200 |
Patchstack | |
| 7.1 High | LearnPress Export Import | Cross-Site Scripting No login needed |
≤ 4.0.9 Fixed in 4.1.0 |
CVE-2025-49992 |
Patchstack | |
| 6.5 Medium | LearnPress – WordPress LMS | Broken Access Control WordPress LMS Plugin <= 4.2.9.3 - Missing Authorization to Unauthenticated Database Table Manipulation No login needed |
≤ 4.2.9.3 |
CVE-2025-11372 |
Wordfence | |
| 4.8 Medium | LearnPress – WordPress LMS | Cross-Site Scripting WordPress LMS Plugin < 4.2.7.5.1 - Admin+ Stored XSS |
< 4.2.7.5.1 Fixed in 4.2.7.5.1 |
CVE-2024-13128 |
WPScan | |
| 4.8 Medium | LearnPress – WordPress LMS | Cross-Site Scripting WordPress LMS Plugin < 4.2.7.5.1 - Admin+ Stored XSS |
< 4.2.7.5.1 Fixed in 4.2.7.5.1 |
CVE-2024-13127 |
WPScan | |
| 5.3 Medium | LearnPress | Broken Access Control No login needed |
≤ 4.2.7.5 Fixed in 4.2.7.6 |
CVE-2025-22739 |
Patchstack | |
| 4.7 Medium | LearnPress | Open Redirect No login needed |
≤ 4.2.7.1 Fixed in 4.2.7.2 |
CVE-2025-24740 |
Patchstack |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.