Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

LearnPress — Vulnerabilities & Security Advisories 36

All 36 CVE vulnerabilities found in LearnPress, with AI-generated Chinese analysis, references, and POCs.

This page aggregates publicly disclosed vulnerabilities associated with the LearnPress product, focusing on common web application weakness types. It collects security advisories and incident reports spanning the last five years, covering issues such as SQL injection, cross-site scripting, and privilege escalation. Readers can use this resource to track LearnPress-specific advisories, understand the frequency of specific weakness classes, and review the product’s overall vulnerability history.

Vendor: ThimPress

CVE ID Title CVSS Severity Published
CVE-2026-104670 WordPress LearnPress plugin <= 4.4.9 - Cross Site Scripting (XSS) vulnerability CWE-79 7.1 High 2026-10-06
CVE-2026-105397 LearnPress WordPress Plugin through 4.4.9.1 Stored XSS via Quiz Question Hint and Explanation CWE-79 5.4 Medium 2026-10-05
CVE-2026-39717 WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability CWE-862 4.3 Medium 2026-10-02
CVE-2026-104403 WordPress LearnPress plugin <= 4.4.9 - Insecure Direct Object References (IDOR) vulnerability CWE-639 5.3 Medium 2026-10-02
CVE-2026-86446 LearnPress 4.4.3 - 4.4.6 - Unauthenticated Quiz Answer Disclosure via check-answer REST Endpoint - - 2026-09-17
CVE-2026-86449 LearnPress < 4.4.7 - Unauthenticated Unpublished Course Disclosure via REST API - - 2026-09-16
CVE-2026-86444 LearnPress < 4.4.7 - Reflected XSS via 'skin' Parameter - - 2026-09-16
CVE-2026-86445 LearnPress < 4.4.7 - Unauthenticated Question Bank Disclosure via load_content_via_ajax - - 2026-09-16
CVE-2026-86448 LearnPress < 4.4.7 - Unauthenticated Order Data Disclosure via lp_download_order - - 2026-09-16
CVE-2026-86447 LearnPress < 4.4.7 - Unauthenticated Student Enrollment Disclosure via load_content_via_ajax - - 2026-09-16
CVE-2026-82024 LearnPress WordPress Plugin < 4.4.6 Stored XSS via Quiz Question Answer Titles CWE-79 5.4 Medium 2026-09-03
CVE-2026-82023 LearnPress WordPress Plugin < 4.4.6 Broken Object-Level Authorization via Quiz Answer Insert CWE-863 4.3 Medium 2026-09-03
CVE-2026-78125 LearnPress – Sepay Payment < 4.0.3 - Unauthenticated Order Status Disclosure - - 2026-08-27
CVE-2026-12976 LearnPress < 4.4.4 - Subscriber+ Sensitive Information Exposure via AI Assistant - - 2026-08-12
CVE-2026-12971 LearnPress < 4.4.4 - Instructor+ Server-Side Request Forgery via openai_apply_image_feature - - 2026-08-10
CVE-2026-12970 LearnPress < 4.4.1 - Reflected XSS via c_search - - 2026-07-20
CVE-2026-8383 LearnPress < 4.3.7 - Unauthenticated Sensitive User Information Disclosure via REST API - - 2026-06-17
CVE-2026-48865 WordPress LearnPress plugin <= 4.3.6 - Reflected Cross Site Scripting (XSS) vulnerability CWE-79 7.1 High 2026-06-01
CVE-2025-66054 WordPress LearnPress plugin <= 4.2.9.4 - Broken Access Control vulnerability CWE-862 7.5 High 2025-12-18
CVE-2025-67536 WordPress LearnPress plugin <= 4.2.9.4 - Cross Site Scripting (XSS) vulnerability CWE-79 6.5 Medium 2025-12-09
CVE-2024-13127 LearnPress – WordPress LMS Plugin < 4.2.7.5.1 - Admin+ Stored XSS 4.8AI Medium AI 2025-05-15
CVE-2024-13128 LearnPress – WordPress LMS Plugin < 4.2.7.5.1 - Admin+ Stored XSS 4.8AI Medium AI 2025-05-15
CVE-2025-22739 WordPress LearnPress plugin <= 4.2.7.5 - Broken Access Control vulnerability CWE-862 5.3 Medium 2025-03-27
CVE-2025-24740 WordPress Learnpress plugin <= 4.2.7.1 - Open Redirection vulnerability CWE-601 4.7 Medium 2025-01-27
CVE-2024-9881 LearnPress < 4.2.7.2 - Admin+ Stored XSS 4.8 - 2024-12-12
CVE-2024-10010 LearnPress < 4.2.7.2 - Admin+ Stored XSS 4.8 - 2024-12-12
CVE-2024-39641 WordPress LearnPress plugin <= 4.2.6.8.2 - Cross Site Request Forgery (CSRF) vulnerability CWE-352 4.3 Medium 2024-08-26
CVE-2024-39642 WordPress LearnPress plugin <= 4.2.6.8.2 - Insecure Direct Object References (IDOR) vulnerability CWE-639 6.5 Medium 2024-08-13
CVE-2023-36515 WordPress LearnPress plugin <= 4.2.3 - Unauthenticated Broken Access Control vulnerability CWE-862 7.3 High 2024-06-19
CVE-2023-36516 WordPress LearnPress plugin <= 4.2.3 - Authenticated Broken Access Control vulnerability CWE-862 7.6 High 2024-06-19

All 36 known CVE vulnerabilities affecting LearnPress with full Chinese analysis, references, and POCs where available.