Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 11

CVE-2026-86445

LearnPress < 4.4.7 - Unauthenticated Question Bank Disclosure via load_content_via_ajax

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative template handlers, allowing unauthenticated attackers to retrieve the text, identifier and type of every published quiz question on the site, along with a keyword search over them, which is content the LearnPress WordPress plugin before 4.4.7 otherwise keeps non-public.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Learnpress Wordpress
Products
Learnpress Wordpress
CVE-2026-86448

LearnPress < 4.4.7 - Unauthenticated Order Data Disclosure via lp_download_order

The LearnPress WordPress plugin before 4.4.7 does not perform any authentication, capability or nonce check before serving a previously generated order export file, allowing unauthenticated attackers who can determine its identifier to download customer names, purchases, amounts and guest email addresses.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Learnpress Wordpress
Products
Learnpress Wordpress
CVE-2026-86449

LearnPress < 4.4.7 - Unauthenticated Unpublished Course Disclosure via REST API

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities before applying a user supplied post status filter in one of its REST routes, allowing unauthenticated attackers to list courses that are not published, including draft, pending, private, scheduled and trashed ones.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Learnpress Wordpress
Products
Learnpress Wordpress
CVE-2026-86447

LearnPress < 4.4.7 - Unauthenticated Student Enrollment Disclosure via load_content_via_ajax

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative course tools, allowing unauthenticated attackers to list every enrolled student's display name and user identifier against the course they are enrolled on, and to recover their email addresses through the same handler's search filter.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Learnpress Wordpress
Products
Learnpress Wordpress
CVE-2026-86446

LearnPress 4.4.3 - 4.4.6 - Unauthenticated Quiz Answer Disclosure via check-answer REST Endpoint

The LearnPress WordPress plugin before 4.4.7 does not restrict the correctness flags it returns when a quiz answer is checked, allowing unauthenticated attackers to obtain the correct answer to every option of a question, along with the instructor's explanation, on courses configured to be taken without enrolling.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Learnpress Wordpress
Products
Learnpress Wordpress
CVE-2026-86444

LearnPress < 4.4.7 - Reflected XSS via 'skin' Parameter

The LearnPress WordPress plugin before 4.4.7 does not escape a user supplied value before using it in an HTML attribute on a public page, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of anyone who opens a crafted link, including a logged in administrator. Only sites running a classic, non-block are affected.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Learnpress Wordpress
Products
Learnpress Wordpress
CVE-2026-78125

LearnPress – Sepay Payment < 4.0.3 - Unauthenticated Order Status Disclosure

The LearnPress WordPress plugin before 4.0.3 does not perform any authorization check on one of its REST endpoints in all versions up to, and including, 4.0.2, allowing unauthenticated attackers to disclose the payment status of arbitrary orders by enumerating order identifiers.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Learnpress Wordpress
Products
Learnpress Wordpress
CVE-2026-12976

LearnPress < 4.4.4 - Subscriber+ Sensitive Information Exposure via AI Assistant

The LearnPress WordPress plugin before 4.4.4 does not verify that a user is enrolled in a course before processing AI-assistant requests against that course's lesson content, allowing any authenticated user such as a subscriber to obtain material from paid courses they have not enrolled in.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Learnpress Wordpress
Products
Learnpress Wordpress
CVE-2026-12971

LearnPress < 4.4.4 - Instructor+ Server-Side Request Forgery via openai_apply_image_feature

The LearnPress WordPress plugin before 4.4.4 does not validate a user-supplied URL before the server fetches it, allowing users with the instructor role to induce the server to issue requests to arbitrary external hosts, a blind and bounded server-side request forgery.

CVSS 3.1 · 2.2 Low EPSS < 1% KEV · Not listed
Vendors
Learnpress Wordpress
Products
Learnpress Wordpress
CVE-2026-12970

LearnPress < 4.4.1 - Reflected XSS via c_search

The LearnPress WordPress plugin before 4.4.1 does not escape a search parameter before reflecting it into an HTML attribute, leading to Reflected Cross-Site Scripting that executes in the browser of a logged-in instructor or administrator who is tricked into opening a crafted link.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Learnpress Wordpress
Products
Learnpress Wordpress
CVE-2026-8383

LearnPress < 4.3.7 - Unauthenticated Sensitive User Information Disclosure via REST API

The LearnPress WordPress plugin before 4.3.7 does not gate the `edit` context on one of its REST endpoint behind the `edit_users` capability, allowing unauthenticated visitors to retrieve each returned user's roles, full capabilities map, extra capabilities, locale, and registration date via a crafted request

CVSS 3.1 · 5.3 Medium EPSS 7.6% KEV · Not listed
Vendors
Learnpress Wordpress
Products
Learnpress Wordpress