Unknown Learnpress – Wordpress LMS Plugin vulnerabilities

4 vulnerabilities

Known vulnerabilities in Unknown Learnpress – Wordpress LMS Plugin, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

4.8CVE-2021-24702thimpresslearnpress+2
EPSS score
0.68%
The LearnPress WordPress plugin before 4.1.3.1 does not properly sanitize or escape various inputs within course settings, which could allow high privilege users to perform Cross-Site Scripting attacks when the unfiltred_html capability is disallowed9.8CVE-2021-24951thimpresslearnpress+2
EPSS score
1.63%
The LearnPress WordPress plugin before 4.1.4 does not sanitise, validate and escape the id parameter before using it in SQL statements when duplicating course/lesson/quiz/question, leading to SQL Injections issues6.1CVE-2022-0271thimpresslearnpress+2
EPSS score
1.94%
The LearnPress WordPress plugin before 4.1.6 does not sanitise and escape the lp-dismiss-notice before outputting it back via the lp_background_single_email AJAX action, leading to a Reflected Cross-Site Scripting9.8CVE-2022-3360thimpresslearnpress+2
EPSS score
2.01%
The LearnPress WordPress plugin before 4.1.7.2 unserialises user input in a REST API endpoint available to unauthenticated users, which could lead to PHP Object Injection when a suitable gadget is present, leadint to remote code execution (RCE). To successfully exploit this vulnerability attackers must have knowledge of the site secrets, allowing them to generate a valid hash via the wp_hash() function.