thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses.

LearnPress <= 4.4.10 - Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via 'search-authors' AJAX Action

• thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
• Broken access control

LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter

• thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
• Insecure deserialization

LearnPress <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' Parameters

• thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
• Cross-site scripting (XSS)

LearnPress <= 4.4.7 - Reflected DOM-Based Cross-Site Scripting via 'orderby' Parameter

• thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
• Cross-site scripting (XSS)

LearnPress <= 4.4.8 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'item_id' Parameter

• thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
• Broken access control

LearnPress <= 4.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'layout_custom_css'

• thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
• Cross-site scripting (XSS)

LearnPress <= 4.4.4 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter

• thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
• SQL injection

LearnPress <= 4.4.4 - Missing Authorization to Authenticated (Editor+) Limited Option Update via 'field_name' Parameter

• thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
• Broken access control

LearnPress <= 4.4.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure via /lp/v1/users/check-answer and /start-quiz REST Endpoints

• thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
• Broken access control

LearnPress <= 4.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class_wrapper_form' Shortcode Attribute

• thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
• Cross-site scripting (XSS)

LearnPress <= 4.3.9.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'userId' Parameter

• thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
• Broken access control

LearnPress <= 4.3.6 - Unauthenticated Sensitive Information Exposure via 'c_status' and 'return_type' Parameters

• thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
• Broken access control

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.5 - Authenticated (Subscriber+) Payment Bypass to Free Course Enrollment via 'quantity' Parameter

• thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
• Broken access control

LearnPress <= 4.3.2.8 - Missing Authorization to Unauthenticated Arbitrary Quiz Answer Deletion

• thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
• Broken access control

LearnPress <= 4.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'skin' Shortcode Attribute

• thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
• Cross-site scripting (XSS)

LearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Answer Deletion

• thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
• Broken access control

LearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Notification Triggering

• thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
• Broken access control

LearnPress – WordPress LMS Plugin <= 4.3.2.4 - Missing Authorization to Unauthenticated Sensitive User Information Disclosure via REST API

• thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
• Broken access control

LearnPress – WordPress LMS Plugin <= 4.3.2.2 - Insecure Direct Object Reference to Authenticated (Instructor+) Teacher Material Deletion

• thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
• Broken access control

LearnPress – WordPress LMS Plugin <= 4.3.2 - Missing Authentication to Unauthenticated Course Modification

• thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
• Broken access control

LearnPress – WordPress LMS Plugin <= 4.3.1 - Missing Authorization to Unauthenticated Orders Statistics Exposure

• thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
• Broken access control

LearnPress – WordPress LMS Plugin <= 4.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via get_profile_social

• thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
• Cross-site scripting (XSS)

LearnPress – WordPress LMS Plugin <= 4.2.9.4 - Missing Authorization to Unauthenticated Arbitrary Callback Execution to Information Exposure

• thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
• Information disclosure

LearnPress – WordPress LMS Plugin <= 4.2.9.3 - Missing Authorization to Unauthenticated Database Table Manipulation

• thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
• Broken access control

LearnPress – WordPress LMS Plugin <= 4.2.7.5 - Authenticated (LP Instructor+) Stored Cross-Site Scripting via Lesson Name

• thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
• Cross-site scripting (XSS)

LearnPress – WordPress LMS Plugin <= 4.2.7.3 - Course Material Sensitive Information Exposure via REST API

• thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
• Broken access control

LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_only_fields'

• thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
• SQL injection

LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_fields'

• thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
• SQL injection

LearnPress – WordPress LMS Plugin <= 4.2.6.9.3 - Authenticated (Contributor+) SQL Injection via order Parameter

• thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
• SQL injection

LearnPress <= 4.2.6.8.2 - Authenticated (Contributor+) Local File Inclusion

• thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
• File inclusion

LearnPress – WordPress LMS Plugin <= 4.2.6.8.1 - Unauthenticated Bypass to User Registration

• thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
• CWE-420

LearnPress – WordPress LMS Plugin <= 4.2.6.8.1 - Missing Authorization to Unauthenticated User Registration Bypass

• thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
• Broken access control

LearnPress – WordPress LMS Plugin <= 4.2.6.8 - Basic Information Disclosure via JSON API

• thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
• Information disclosure

LearnPress – WordPress LMS Plugin <= 4.2.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter

• thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
• Cross-site scripting (XSS)

LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via layout_html Parameter

• thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
• Cross-site scripting (XSS)

LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Bypass to User Registration

• thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
• CWE-420

LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Time-Based SQL Injection

• thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
• SQL injection

LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Authenticated (Instructor+) Arbitrary File Upload

• thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
• Unrestricted file upload

LearnPress – WordPress LMS Plugin <= 4.2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

• thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
• Cross-site scripting (XSS)

LearnPress <= 4.2.6.3 - Authenticated(LP Instructor+) Stored Cross-Site Scripting

• thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
• Cross-site scripting (XSS)

LearnPress <= 4.2.6.3 - Insecure Direct Object Reference

• thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
• Broken access control

LearnPress – WordPress LMS Plugin <= 4.0.0 - Cross-Site Request Forgery to Privilege Escalation

• thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
• Cross-site request forgery (CSRF)

LearnPress <= 4.2.5.7 - Unauthenticated SQL Injection via order_by

• thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
• SQL injection

LearnPress <= 4.2.5.7 - Command Injection

• thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
• Command injection

LearnPress <= 4.2.5.7 - Insecure Direct Object Reference to Information Disclosure

• thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
• Broken access control