# thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses.

Every CVE that names thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [LearnPress <= 4.4.10 - Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via 'search-authors' AJAX Action](https://agentprime.io/advisories/CVE-2026-107744.md)
  `CVE-2026-107744` · CVE record: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · CVSS 6.5 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: Broken access control
- [LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter](https://agentprime.io/advisories/CVE-2026-104736.md)
  `CVE-2026-104736` · CVE record: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Oct 2026 · Tags: Insecure deserialization
- [LearnPress <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' Parameters](https://agentprime.io/advisories/CVE-2026-109208.md)
  `CVE-2026-109208` · CVE record: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · CVSS 7.2 High · Not analysed yet · Published 17 Oct 2026 · Tags: Cross-site scripting (XSS)
- [LearnPress <= 4.4.7 - Reflected DOM-Based Cross-Site Scripting via 'orderby' Parameter](https://agentprime.io/advisories/CVE-2026-92538.md)
  `CVE-2026-92538` · CVE record: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · CVSS 6.1 Medium · Not analysed yet · Published 3 Oct 2026 · Tags: Cross-site scripting (XSS)
- [LearnPress <= 4.4.8 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'item_id' Parameter](https://agentprime.io/advisories/CVE-2026-93882.md)
  `CVE-2026-93882` · CVE record: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · CVSS 7.5 High · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [LearnPress <= 4.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'layout_custom_css'](https://agentprime.io/advisories/CVE-2026-12230.md)
  `CVE-2026-12230` · CVE record: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · CVSS 6.4 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: Cross-site scripting (XSS)
- [LearnPress <= 4.4.4 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter](https://agentprime.io/advisories/CVE-2026-77823.md)
  `CVE-2026-77823` · CVE record: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · CVSS 4.9 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: SQL injection
- [LearnPress <= 4.4.4 - Missing Authorization to Authenticated (Editor+) Limited Option Update via 'field_name' Parameter](https://agentprime.io/advisories/CVE-2026-75982.md)
  `CVE-2026-75982` · CVE record: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · CVSS 4.4 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: Broken access control
- [LearnPress <= 4.4.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure via /lp/v1/users/check-answer and /start-quiz REST Endpoints](https://agentprime.io/advisories/CVE-2026-13765.md)
  `CVE-2026-13765` · CVE record: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · CVSS 7.5 High · Not analysed yet · Published 17 Jul 2026 · Tags: Broken access control
- [LearnPress <= 4.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class_wrapper_form' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-12732.md)
  `CVE-2026-12732` · CVE record: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · CVSS 6.4 Medium · Not analysed yet · Published 1 Jul 2026 · Tags: Cross-site scripting (XSS)
- [LearnPress <= 4.3.9.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'userId' Parameter](https://agentprime.io/advisories/CVE-2026-11988.md)
  `CVE-2026-11988` · CVE record: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · CVSS 6.5 Medium · Not analysed yet · Published 1 Jul 2026 · Tags: Broken access control
- [LearnPress <= 4.3.6 - Unauthenticated Sensitive Information Exposure via 'c_status' and 'return_type' Parameters](https://agentprime.io/advisories/CVE-2026-8502.md)
  `CVE-2026-8502` · CVE record: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · CVSS 5.3 Medium · Not analysed yet · Published 6 Jun 2026 · Tags: Broken access control
- [LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.5 - Authenticated (Subscriber+) Payment Bypass to Free Course Enrollment via 'quantity' Parameter](https://agentprime.io/advisories/CVE-2026-7648.md)
  `CVE-2026-7648` · CVE record: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · CVSS 4.3 Medium · Not analysed yet · Published 14 May 2026 · Tags: Broken access control
- [LearnPress <= 4.3.2.8 - Missing Authorization to Unauthenticated Arbitrary Quiz Answer Deletion](https://agentprime.io/advisories/CVE-2026-4365.md)
  `CVE-2026-4365` · CVE record: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Apr 2026 · Tags: Broken access control
- [LearnPress <= 4.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'skin' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-4333.md)
  `CVE-2026-4333` · CVE record: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · CVSS 6.4 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: Cross-site scripting (XSS)
- [LearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Answer Deletion](https://agentprime.io/advisories/CVE-2026-3225.md)
  `CVE-2026-3225` · CVE record: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · CVSS 4.3 Medium · Not analysed yet · Published 23 Mar 2026 · Tags: Broken access control
- [LearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Notification Triggering](https://agentprime.io/advisories/CVE-2026-3226.md)
  `CVE-2026-3226` · CVE record: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · CVSS 4.3 Medium · Not analysed yet · Published 12 Mar 2026 · Tags: Broken access control
- [LearnPress – WordPress LMS Plugin <= 4.3.2.4 - Missing Authorization to Unauthenticated Sensitive User Information Disclosure via REST API](https://agentprime.io/advisories/CVE-2025-14798.md)
  `CVE-2025-14798` · CVE record: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · CVSS 5.3 Medium · Not analysed yet · Published 20 Jan 2026 · Tags: Broken access control
- [LearnPress – WordPress LMS Plugin <= 4.3.2.2 - Insecure Direct Object Reference to Authenticated (Instructor+) Teacher Material Deletion](https://agentprime.io/advisories/CVE-2025-14802.md)
  `CVE-2025-14802` · CVE record: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · CVSS 5.4 Medium · Not analysed yet · Published 7 Jan 2026 · Tags: Broken access control
- [LearnPress – WordPress LMS Plugin <= 4.3.2 - Missing Authentication to Unauthenticated Course Modification](https://agentprime.io/advisories/CVE-2025-13964.md)
  `CVE-2025-13964` · CVE record: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · CVSS 5.3 Medium · Not analysed yet · Published 6 Jan 2026 · Tags: Broken access control
- [LearnPress – WordPress LMS Plugin <= 4.3.1 - Missing Authorization to Unauthenticated Orders Statistics Exposure](https://agentprime.io/advisories/CVE-2025-13956.md)
  `CVE-2025-13956` · CVE record: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · CVSS 5.3 Medium · Not analysed yet · Published 16 Dec 2025 · Tags: Broken access control
- [LearnPress – WordPress LMS Plugin <= 4.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via get_profile_social](https://agentprime.io/advisories/CVE-2025-14387.md)
  `CVE-2025-14387` · CVE record: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · CVSS 6.4 Medium · Not analysed yet · Published 15 Dec 2025 · Tags: Cross-site scripting (XSS)
- [LearnPress – WordPress LMS Plugin <= 4.2.9.4 - Missing Authorization to Unauthenticated Arbitrary Callback Execution to Information Exposure](https://agentprime.io/advisories/CVE-2025-11368.md)
  `CVE-2025-11368` · CVE record: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · CVSS 5.3 Medium · Not analysed yet · Published 21 Nov 2025 · Tags: Information disclosure
- [LearnPress – WordPress LMS Plugin <= 4.2.9.3 - Missing Authorization to Unauthenticated Database Table Manipulation](https://agentprime.io/advisories/CVE-2025-11372.md)
  `CVE-2025-11372` · CVE record: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · CVSS 6.5 Medium · Not analysed yet · Published 18 Oct 2025 · Tags: Broken access control
- [LearnPress – WordPress LMS Plugin <= 4.2.7.5 - Authenticated (LP Instructor+) Stored Cross-Site Scripting via Lesson Name](https://agentprime.io/advisories/CVE-2024-13599.md)
  `CVE-2024-13599` · CVE record: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · CVSS 6.4 Medium · Not analysed yet · Published 25 Jan 2025 · Tags: Cross-site scripting (XSS)
- [LearnPress – WordPress LMS Plugin <= 4.2.7.3 - Course Material Sensitive Information Exposure via REST API](https://agentprime.io/advisories/CVE-2024-11868.md)
  `CVE-2024-11868` · CVE record: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · CVSS 5.3 Medium · Not analysed yet · Published 10 Dec 2024 · Tags: Broken access control
- [LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_only_fields'](https://agentprime.io/advisories/CVE-2024-8522.md)
  `CVE-2024-8522` · CVE record: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · CVSS 10.0 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.63 · Not analysed yet · Published 12 Sept 2024 · Tags: SQL injection
- [LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_fields'](https://agentprime.io/advisories/CVE-2024-8529.md)
  `CVE-2024-8529` · CVE record: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · CVSS 10.0 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.12 · Not analysed yet · Published 12 Sept 2024 · Tags: SQL injection
- [LearnPress – WordPress LMS Plugin <= 4.2.6.9.3 - Authenticated (Contributor+) SQL Injection via order Parameter](https://agentprime.io/advisories/CVE-2024-7548.md)
  `CVE-2024-7548` · CVE record: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · CVSS 8.8 High · Not analysed yet · Published 8 Aug 2024 · Tags: SQL injection
- [LearnPress <= 4.2.6.8.2 - Authenticated (Contributor+) Local File Inclusion](https://agentprime.io/advisories/CVE-2024-6589.md)
  `CVE-2024-6589` · CVE record: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · CVSS 8.8 High · Not analysed yet · Published 25 Jul 2024 · Tags: File inclusion
- [LearnPress – WordPress LMS Plugin <= 4.2.6.8.1 - Unauthenticated Bypass to User Registration](https://agentprime.io/advisories/CVE-2024-6099.md)
  `CVE-2024-6099` · CVE record: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · CVSS 5.3 Medium · Not analysed yet · Published 2 Jul 2024 · Tags: CWE-420
- [LearnPress – WordPress LMS Plugin <= 4.2.6.8.1 - Missing Authorization to Unauthenticated User Registration Bypass](https://agentprime.io/advisories/CVE-2024-6088.md)
  `CVE-2024-6088` · CVE record: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · CVSS 5.3 Medium · Not analysed yet · Published 2 Jul 2024 · Tags: Broken access control
- [LearnPress – WordPress LMS Plugin <= 4.2.6.8 - Basic Information Disclosure via JSON API](https://agentprime.io/advisories/CVE-2024-5483.md)
  `CVE-2024-5483` · CVE record: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · CVSS 5.3 Medium · Not analysed yet · Published 5 Jun 2024 · Tags: Information disclosure
- [LearnPress – WordPress LMS Plugin <= 4.2.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter](https://agentprime.io/advisories/CVE-2024-4971.md)
  `CVE-2024-4971` · CVE record: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · CVSS 6.4 Medium · Not analysed yet · Published 22 May 2024 · Tags: Cross-site scripting (XSS)
- [LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via layout_html Parameter](https://agentprime.io/advisories/CVE-2024-4277.md)
  `CVE-2024-4277` · CVE record: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · CVSS 6.4 Medium · Not analysed yet · Published 10 May 2024 · Tags: Cross-site scripting (XSS)
- [LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Bypass to User Registration](https://agentprime.io/advisories/CVE-2024-4444.md)
  `CVE-2024-4444` · CVE record: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · CVSS 5.3 Medium · Not analysed yet · Published 10 May 2024 · Tags: CWE-420
- [LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Time-Based SQL Injection](https://agentprime.io/advisories/CVE-2024-4434.md)
  `CVE-2024-4434` · CVE record: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.37 · Not analysed yet · Published 10 May 2024 · Tags: SQL injection
- [LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Authenticated (Instructor+) Arbitrary File Upload](https://agentprime.io/advisories/CVE-2024-4397.md)
  `CVE-2024-4397` · CVE record: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · CVSS 8.8 High · Not analysed yet · Published 9 May 2024 · Tags: Unrestricted file upload
- [LearnPress – WordPress LMS Plugin <= 4.2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2024-3560.md)
  `CVE-2024-3560` · CVE record: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · CVSS 6.4 Medium · Not analysed yet · Published 19 Apr 2024 · Tags: Cross-site scripting (XSS)
- [LearnPress <= 4.2.6.3 - Authenticated(LP Instructor+) Stored Cross-Site Scripting](https://agentprime.io/advisories/CVE-2024-1463.md)
  `CVE-2024-1463` · CVE record: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · CVSS 4.4 Medium · Not analysed yet · Published 9 Apr 2024 · Tags: Cross-site scripting (XSS)
- [LearnPress <= 4.2.6.3 - Insecure Direct Object Reference](https://agentprime.io/advisories/CVE-2024-1289.md)
  `CVE-2024-1289` · CVE record: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · CVSS 6.5 Medium · Not analysed yet · Published 9 Apr 2024 · Tags: Broken access control
- [LearnPress – WordPress LMS Plugin <= 4.0.0 - Cross-Site Request Forgery to Privilege Escalation](https://agentprime.io/advisories/CVE-2024-2115.md)
  `CVE-2024-2115` · CVE record: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · CVSS 8.8 High · Not analysed yet · Published 5 Apr 2024 · Tags: Cross-site request forgery (CSRF)
- [LearnPress <= 4.2.5.7 - Unauthenticated SQL Injection via order_by](https://agentprime.io/advisories/CVE-2023-6567.md)
  `CVE-2023-6567` · CVE record: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.51 · Not analysed yet · Published 11 Jan 2024 · Tags: SQL injection
- [LearnPress <= 4.2.5.7 - Command Injection](https://agentprime.io/advisories/CVE-2023-6634.md)
  `CVE-2023-6634` · CVE record: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · CVSS 8.1 High · Not analysed yet · Published 11 Jan 2024 · Tags: Command injection
- [LearnPress <= 4.2.5.7 - Insecure Direct Object Reference to Information Disclosure](https://agentprime.io/advisories/CVE-2023-6223.md)
  `CVE-2023-6223` · CVE record: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · CVSS 4.3 Medium · Not analysed yet · Published 11 Jan 2024 · Tags: Broken access control

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=thimpress-learnpress-wordpress-lms-plugin-for-create-and-sell-online-courses>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/thimpress-learnpress-wordpress-lms-plugin-for-create-and-sell-online-courses/>. Everything for agents: <https://agentprime.io/llms.txt>.