Advisories · Technology
StellarWP LearnDash LMS.
Every CVE that names StellarWP LearnDash LMS among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.4 Medium
LearnDash LMS 4.25.0 - 5.1.6 - Unauthenticated Arbitrary Course Enrollment via REST Endpoint
- StellarWP LearnDash LMS
- Broken access control
- CVSS 7.5 High
LearnDash LMS <= 5.1.5 - Authenticated (Subscriber+) Arbitrary File Upload via Assignment Upload Handler
- StellarWP LearnDash LMS
- Unrestricted file upload
- CVSS 6.5 Medium
LearnDash LMS <= 5.0.3 - Authenticated (Contributor+) SQL Injection via 'filters[orderby_order]' Parameter
- StellarWP LearnDash LMS
- SQL injection
- CVSS 5.3 Medium
LearnDash LMS <= 4.10.2 - Sensitive Information Exposure via API
- StellarWP LearnDash LMS
- Information disclosure
- CVSS 5.3 Medium
LearnDash LMS <= 4.10.1 - Sensitive Information Exposure via assignments
- StellarWP LearnDash LMS
- Information disclosure
- CVSS 5.3 Medium
LearnDash LMS <= 4.10.1 - Sensitive Information Exposure via API
- StellarWP LearnDash LMS
- Information disclosure
- CVSS 8.8 High
LearnDash LMS <= 4.6.0 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Password Change
- StellarWP LearnDash LMS
- Broken access control