Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-52713 (GCVE-0-2026-52713)

Vulnerability from nvd – Published: 2026-11-07 09:03 – Updated: 2026-11-07 18:36 X_Open Source

Title

WordPress LearnPress plugin <= 4.4.12 - Broken Access Control vulnerability

Summary

Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.12.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-07 18:16 UTC

CWE

CWE-862 - Missing Authorization

Assigner

Patchstack CNA under the mitre root

CNA scorecard B 75/100 over 3528 records in the last 180 days details

References

1 reference

URL	Tags
https://patchstack.com/database/wordpress/plugin/…	vdb-entry

Impacted products

1 product

Vendor	Product	Version
ThimPress	LearnPress	Affected: 0 , ≤ 4.4.12 (custom)

Date Public

2026-11-07 09:03

Credits

Alveni | Patchstack Bug Bounty Program

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-52713",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T18:16:57.132531Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T18:36:41.908Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "learnpress",
          "product": "LearnPress",
          "vendor": "ThimPress",
          "versions": [
            {
              "changes": [
                {
                  "at": "4.4.13",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "4.4.12",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Alveni | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-11-07T09:03:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects LearnPress: from n/a through 4.4.12.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.12."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T09:04:32.430Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/learnpress/vulnerability/wordpress-learnpress-plugin-4-4-12-broken-access-control-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress LearnPress plugin to the latest available version (at least 4.4.13)."
            }
          ],
          "value": "Update the WordPress LearnPress plugin to the latest available version (at least 4.4.13)."
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "WordPress LearnPress plugin \u003c= 4.4.12 - Broken Access Control vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-52713",
    "datePublished": "2026-11-07T09:03:26.066Z",
    "dateReserved": "2026-06-08T10:11:21.891Z",
    "dateUpdated": "2026-11-07T18:36:41.908Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118054 (GCVE-0-2026-118054)

Vulnerability from nvd – Published: 2026-11-07 02:29 – Updated: 2026-11-07 18:06

Title

LearnPress <= 4.2.2 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'review_title' Parameter

Summary

The LearnPress – Course Review plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'review_title (inside `data.args.review_title`)' parameter in all versions up to, and including, 4.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload only executes after an administrator approves the submitted review, though sites with comment_previously_approved auto-approval configured may bypass manual moderation.

Severity

6.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-07 18:03 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation

Assigner

Wordfence CNA under the mitre root

CNA scorecard C 65/100 over 2430 records in the last 180 days details

References

6 references

URL	Tags
https://www.wordfence.com/threat-intel/vulnerabil…
https://plugins.trac.wordpress.org/browser/learnp…
https://plugins.trac.wordpress.org/browser/learnp…
https://plugins.trac.wordpress.org/browser/learnp…
https://plugins.trac.wordpress.org/browser/learnp…
https://plugins.trac.wordpress.org/browser/learnp…

Impacted products

1 product

Vendor	Product	Version
thimpress	LearnPress – Course Review	Affected: 0 , ≤ 4.2.2 (semver)

Credits

jiahao

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-118054",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T18:03:24.261727Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T18:06:10.042Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "LearnPress \u2013 Course Review",
          "vendor": "thimpress",
          "versions": [
            {
              "lessThanOrEqual": "4.2.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "jiahao"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The LearnPress \u2013 Course Review plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the \u0027review_title (inside `data.args.review_title`)\u0027 parameter in all versions up to, and including, 4.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload only executes after an administrator approves the submitted review, though sites with comment_previously_approved auto-approval configured may bypass manual moderation."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T02:29:11.216Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0f166e2e-6dd5-4453-8448-b7d7905dbf49?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress-course-review/tags/4.2.2/inc/TemplateHooks/CourseRatingTemplate.php#L397"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress-course-review/tags/4.2.2/inc/TemplateHooks/CourseRatingTemplate.php#L640"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress-course-review/tags/4.2.2/inc/load.php#L569"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress-course-review/tags/4.2.2/inc/functions.php#L208"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress-course-review/tags/4.2.3/inc/TemplateHooks/CourseRatingTemplate.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-27T15:42:59.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-11-06T14:09:17.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "LearnPress \u003c= 4.2.2 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via \u0027review_title\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-118054",
    "datePublished": "2026-11-07T02:29:11.216Z",
    "dateReserved": "2026-10-27T15:24:39.784Z",
    "dateUpdated": "2026-11-07T18:06:10.042Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-42690 (GCVE-0-2026-42690)

Vulnerability from nvd – Published: 2026-10-29 15:23 – Updated: 2026-10-29 17:17

Title

WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability

Summary

Subscriber Broken Access Control in LearnPress <= 4.4.10 versions.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-29 16:15 UTC

CWE

CWE-862 - Missing Authorization

Assigner

Patchstack CNA under the mitre root

CNA scorecard B 75/100 over 3528 records in the last 180 days details

References

1 reference

URL	Tags
https://patchstack.com/database/wordpress/plugin/…	vdb-entry

Impacted products

1 product

Vendor	Product	Version
ThimPress	LearnPress	Affected: n/a , ≤ 4.4.10 (custom)

Credits

Ananda Dhakal (Patchstack) | Patchstack Bug Bounty Program

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42690",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-29T16:15:53.953176Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-29T17:17:08.164Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "learnpress",
          "product": "LearnPress",
          "vendor": "ThimPress",
          "versions": [
            {
              "changes": [
                {
                  "at": "4.4.11",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "4.4.10",
              "status": "affected",
              "version": "n/a",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Ananda Dhakal (Patchstack) | Patchstack Bug Bounty Program"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Subscriber Broken Access Control in LearnPress \u003c= 4.4.10 versions."
            }
          ],
          "value": "Subscriber Broken Access Control in LearnPress \u003c= 4.4.10 versions."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T15:23:58.663Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/learnpress/vulnerability/wordpress-learnpress-plugin-4-4-10-broken-access-control-vulnerability-2?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "No patched version available."
            }
          ],
          "value": "No patched version available."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "WordPress LearnPress plugin \u003c= 4.4.10 - Broken Access Control vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-42690",
    "datePublished": "2026-10-29T15:23:58.663Z",
    "dateReserved": "2026-04-29T09:05:01.790Z",
    "dateUpdated": "2026-10-29T17:17:08.164Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-115599 (GCVE-0-2026-115599)

Vulnerability from nvd – Published: 2026-10-29 11:00 – Updated: 2026-10-29 12:36 X_Open Source

Title

WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability

Summary

Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.11.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-29 12:18 UTC

CWE

CWE-862 - Missing Authorization

Assigner

Patchstack CNA under the mitre root

CNA scorecard B 75/100 over 3528 records in the last 180 days details

References

1 reference

URL	Tags
https://patchstack.com/database/wordpress/plugin/…	vdb-entry

Impacted products

1 product

Vendor	Product	Version
ThimPress	LearnPress	Affected: 0 , ≤ 4.4.11 (custom)

Date Public

2026-10-27 10:23

Credits

MinKhoy - VinSOC | Patchstack Bug Bounty Program

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-115599",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-29T12:18:31.065282Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-29T12:36:52.417Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "learnpress",
          "product": "LearnPress",
          "vendor": "ThimPress",
          "versions": [
            {
              "changes": [
                {
                  "at": "4.4.12",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "4.4.11",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "MinKhoy - VinSOC | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-10-27T10:23:39.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects LearnPress: from n/a through 4.4.11.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.11."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T11:00:24.169Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/learnpress/vulnerability/wordpress-learnpress-plugin-4-4-11-broken-access-control-vulnerability-3?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress LearnPress plugin to the latest available version (at least 4.4.12)."
            }
          ],
          "value": "Update the WordPress LearnPress plugin to the latest available version (at least 4.4.12)."
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "WordPress LearnPress plugin \u003c= 4.4.11 - Broken Access Control vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-115599",
    "datePublished": "2026-10-29T11:00:24.169Z",
    "dateReserved": "2026-10-23T00:18:53.712Z",
    "dateUpdated": "2026-10-29T12:36:52.417Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-115598 (GCVE-0-2026-115598)

Vulnerability from nvd – Published: 2026-10-26 16:45 – Updated: 2026-10-26 17:37 X_Open Source

Title

WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability

Summary

Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.11.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-26 17:23 UTC

CWE

CWE-862 - Missing Authorization

Assigner

Patchstack CNA under the mitre root

CNA scorecard B 75/100 over 3528 records in the last 180 days details

References

1 reference

URL	Tags
https://patchstack.com/database/wordpress/plugin/…	vdb-entry

Impacted products

1 product

Vendor	Product	Version
ThimPress	LearnPress	Affected: 0 , ≤ 4.4.11 (custom)

Date Public

2026-10-26 16:44

Credits

ssophiz | Patchstack Bug Bounty Program

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-115598",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-26T17:23:02.331267Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-26T17:37:09.543Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "learnpress",
          "product": "LearnPress",
          "vendor": "ThimPress",
          "versions": [
            {
              "changes": [
                {
                  "at": "4.4.12",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "4.4.11",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "ssophiz | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-10-26T16:44:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects LearnPress: from n/a through 4.4.11.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.11."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-26T16:45:19.394Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/learnpress/vulnerability/wordpress-learnpress-plugin-4-4-11-broken-access-control-vulnerability-2?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress LearnPress plugin to the latest available version (at least 4.4.12)."
            }
          ],
          "value": "Update the WordPress LearnPress plugin to the latest available version (at least 4.4.12)."
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "WordPress LearnPress plugin \u003c= 4.4.11 - Broken Access Control vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-115598",
    "datePublished": "2026-10-26T16:45:11.621Z",
    "dateReserved": "2026-10-23T00:18:53.712Z",
    "dateUpdated": "2026-10-26T17:37:09.543Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-115597 (GCVE-0-2026-115597)

Vulnerability from nvd – Published: 2026-10-26 16:43 – Updated: 2026-10-26 17:37 X_Open Source

Title

WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability

Summary

Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.11.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-26 17:23 UTC

CWE

CWE-862 - Missing Authorization

Assigner

Patchstack CNA under the mitre root

CNA scorecard B 75/100 over 3528 records in the last 180 days details

References

1 reference

URL	Tags
https://patchstack.com/database/wordpress/plugin/…	vdb-entry

Impacted products

1 product

Vendor	Product	Version
ThimPress	LearnPress	Affected: 0 , ≤ 4.4.11 (custom)

Date Public

2026-10-26 16:43

Credits

Harry Nguyen | Patchstack Bug Bounty Program

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-115597",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-26T17:23:25.354103Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-26T17:37:09.885Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "learnpress",
          "product": "LearnPress",
          "vendor": "ThimPress",
          "versions": [
            {
              "changes": [
                {
                  "at": "4.4.12",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "4.4.11",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Harry Nguyen | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-10-26T16:43:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects LearnPress: from n/a through 4.4.11.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.11."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-26T16:44:22.242Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/learnpress/vulnerability/wordpress-learnpress-plugin-4-4-11-broken-access-control-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress LearnPress plugin to the latest available version (at least 4.4.12)."
            }
          ],
          "value": "Update the WordPress LearnPress plugin to the latest available version (at least 4.4.12)."
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "WordPress LearnPress plugin \u003c= 4.4.11 - Broken Access Control vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-115597",
    "datePublished": "2026-10-26T16:43:22.281Z",
    "dateReserved": "2026-10-23T00:18:53.712Z",
    "dateUpdated": "2026-10-26T17:37:09.885Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-113353 (GCVE-0-2026-113353)

Vulnerability from nvd – Published: 2026-10-20 10:41 – Updated: 2026-10-20 14:32

Title

LearnPress before 4.4.10 Missing Authorization via Legacy Editor AJAX Handlers

Summary

LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor and admin_question_editor lp-ajax actions, allowing instructors to modify other instructors' content. Authenticated instructors can reuse their own generic editor nonce with another object's id parameter to alter courses, change quiz answers, and trash questions.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-20 14:32 UTC

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7803 records in the last 180 days details

References

6 references

URL	Tags
https://github.com/LearnPress/learnpress/commit/7…	patch
https://plugins.svn.wordpress.org/learnpress/tags…	technical-description
https://plugins.svn.wordpress.org/learnpress/tags…	technical-description
https://learnpresslms.com/changelog/	release-notes
https://wordpress.org/plugins/learnpress/	product
https://www.vulncheck.com/advisories/learnpress-b…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
ThimPress	LearnPress	Affected: 0 , < 4.4.10 (semver) cpe:2.3:a:thimpress:learnpress::::::wordpress::*

Date Public

2026-10-09 01:50

Credits

Trần Văn Hoàng

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-113353",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-20T14:32:42.250134Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-20T14:32:51.446Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "LearnPress",
          "vendor": "ThimPress",
          "versions": [
            {
              "lessThan": "4.4.10",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:thimpress:learnpress:*:*:*:*:*:wordpress:*:*",
                  "versionEndExcluding": "4.4.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Tr\u1ea7n V\u0103n Ho\u00e0ng"
        }
      ],
      "datePublic": "2026-10-09T01:50:25.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor and admin_question_editor lp-ajax actions, allowing instructors to modify other instructors\u0027 content. Authenticated instructors can reuse their own generic editor nonce with another object\u0027s id parameter to alter courses, change quiz answers, and trash questions."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-20T10:41:38.826Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/LearnPress/learnpress/commit/77087dcdc0e974e8d0844453b4071189fc2c70d2"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://plugins.svn.wordpress.org/learnpress/tags/4.4.9.1/inc/admin/editor/class-lp-admin-editor-course.php"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://plugins.svn.wordpress.org/learnpress/tags/4.4.9.1/inc/admin/class-lp-admin-ajax.php"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://learnpresslms.com/changelog/"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://wordpress.org/plugins/learnpress/"
        },
        {
          "name": "VulnCheck Advisory: LearnPress before 4.4.10 Missing Authorization via Legacy Editor AJAX Handlers",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/learnpress-before-4.4.10-missing-authorization-via-legacy-editor-ajax-handlers"
        }
      ],
      "title": "LearnPress before 4.4.10 Missing Authorization via Legacy Editor AJAX Handlers",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-113353",
    "datePublished": "2026-10-20T10:41:38.826Z",
    "dateReserved": "2026-10-20T01:07:46.397Z",
    "dateUpdated": "2026-10-20T14:32:51.446Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-110363 (GCVE-0-2026-110363)

Vulnerability from nvd – Published: 2026-10-19 12:21 – Updated: 2026-10-19 18:15 X_Open Source

Title

WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability

Summary

Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.10.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-19 18:15 UTC

CWE

CWE-862 - Missing Authorization

Assigner

Patchstack CNA under the mitre root

CNA scorecard B 75/100 over 3528 records in the last 180 days details

References

1 reference

URL	Tags
https://patchstack.com/database/wordpress/plugin/…	vdb-entry

Impacted products

1 product

Vendor	Product	Version
ThimPress	LearnPress	Affected: 0 , ≤ 4.4.10 (custom)

Date Public

2026-10-19 12:21

Credits

MD Mahmidul Hasan | Patchstack Bug Bounty Program

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-110363",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-19T18:15:07.114360Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T18:15:27.691Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "learnpress",
          "product": "LearnPress",
          "vendor": "ThimPress",
          "versions": [
            {
              "changes": [
                {
                  "at": "4.4.11",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "4.4.10",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "MD Mahmidul Hasan | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-10-19T12:21:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects LearnPress: from n/a through 4.4.10.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.10."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T12:21:58.945Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/learnpress/vulnerability/wordpress-learnpress-plugin-4-4-10-broken-access-control-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress LearnPress plugin to the latest available version (at least 4.4.11)."
            }
          ],
          "value": "Update the WordPress LearnPress plugin to the latest available version (at least 4.4.11)."
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "WordPress LearnPress plugin \u003c= 4.4.10 - Broken Access Control vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-110363",
    "datePublished": "2026-10-19T12:21:58.494Z",
    "dateReserved": "2026-10-14T00:22:17.448Z",
    "dateUpdated": "2026-10-19T18:15:27.691Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-107744 (GCVE-0-2026-107744)

Vulnerability from nvd – Published: 2026-10-17 03:43 – Updated: 2026-10-18 11:22

Title

LearnPress <= 4.4.10 - Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via 'search-authors' AJAX Action

Summary

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.10 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to enumerate the complete site user roster and extract the full email address of any WordPress account, including administrator accounts, character-by-character by using the search response as an oracle against both user_login and user_email columns.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-18 11:07 UTC

CWE

CWE-862 - Missing Authorization

Assigner

Wordfence CNA under the mitre root

CNA scorecard C 65/100 over 2430 records in the last 180 days details

References

5 references

URL	Tags
https://www.wordfence.com/threat-intel/vulnerabil…
https://plugins.trac.wordpress.org/browser/learnp…
https://plugins.trac.wordpress.org/browser/learnp…
https://plugins.trac.wordpress.org/browser/learnp…
https://plugins.trac.wordpress.org/changeset/3750…

Impacted products

1 product

Vendor	Product	Version
thimpress	LearnPress – WordPress LMS Plugin for Create and Sell Online Courses	Affected: 0 , ≤ 4.4.10 (semver)

Credits

Kuba

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107744",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-18T11:07:56.529901Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-18T11:22:46.337Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses",
          "vendor": "thimpress",
          "versions": [
            {
              "lessThanOrEqual": "4.4.10",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Kuba"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.10 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to enumerate the complete site user roster and extract the full email address of any WordPress account, including administrator accounts, character-by-character by using the search response as an oracle against both user_login and user_email columns."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-17T03:43:30.064Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d1894596-b430-41b3-9d28-12c7dea7ff9b?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.9.1/inc/admin/class-lp-admin-ajax.php#L105"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.9.1/inc/admin/class-lp-admin-ajax.php#L80"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.9.1/inc/class-lp-request-handler.php#L173"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3750011/learnpress/trunk/inc/admin/class-lp-admin-ajax.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-08T18:40:24.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-16T14:31:20.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "LearnPress \u003c= 4.4.10 - Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via \u0027search-authors\u0027 AJAX Action"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-107744",
    "datePublished": "2026-10-17T03:43:30.064Z",
    "dateReserved": "2026-10-08T18:25:02.823Z",
    "dateUpdated": "2026-10-18T11:22:46.337Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-104736 (GCVE-0-2026-104736)

Vulnerability from nvd – Published: 2026-10-17 03:43 – Updated: 2026-10-18 11:22

Title

LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter

Summary

The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout-email' request parameter during the checkout AJAX action. The value is passed through sanitize_text_field(), which does not strip serialized object syntax, then stored in the LearnPress session table and later fed to LP_Helper::maybe_unserialize() → unserialize() (without an allowed_classes restriction) by LP_Session_Handler::get() on subsequent requests. This makes it possible for unauthenticated attackers to inject a PHP Object.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-18 11:08 UTC

CWE

CWE-502 - Deserialization of Untrusted Data

Assigner

Wordfence CNA under the mitre root

CNA scorecard C 65/100 over 2430 records in the last 180 days details

References

6 references

URL	Tags
https://www.wordfence.com/threat-intel/vulnerabil…
https://plugins.trac.wordpress.org/browser/learnp…
https://plugins.trac.wordpress.org/browser/learnp…
https://plugins.trac.wordpress.org/browser/learnp…
https://plugins.trac.wordpress.org/browser/learnp…
https://plugins.trac.wordpress.org/changeset?repo…

Impacted products

1 product

Vendor	Product	Version
thimpress	LearnPress – WordPress LMS Plugin for Create and Sell Online Courses	Affected: 0 , ≤ 4.4.10 (semver)

Credits

Wordfence PRISM

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104736",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-18T11:08:40.232447Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-18T11:22:46.937Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses",
          "vendor": "thimpress",
          "versions": [
            {
              "lessThanOrEqual": "4.4.10",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the \u0027checkout-email\u0027 request parameter during the checkout AJAX action. The value is passed through sanitize_text_field(), which does not strip serialized object syntax, then stored in the LearnPress session table and later fed to LP_Helper::maybe_unserialize() \u2192 unserialize() (without an allowed_classes restriction) by LP_Session_Handler::get() on subsequent requests. This makes it possible for unauthenticated attackers to inject a PHP Object."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-17T03:43:28.046Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3e28e008-0ec1-4262-9ac0-6170cf8b8bdf?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.9.1/inc/class-lp-session-handler.php#L373"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.9.1/inc/class-lp-checkout.php#L377"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.9.1/inc/class-lp-checkout.php#L523"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.9.1/inc/class-lp-ajax.php#L21"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3750024%40learnpress\u0026new=3750024%40learnpress"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-02T12:07:17.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-16T14:33:32.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "LearnPress \u003c= 4.4.10 - Unauthenticated PHP Object Injection via \u0027checkout-email\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-104736",
    "datePublished": "2026-10-17T03:43:28.046Z",
    "dateReserved": "2026-10-02T11:52:06.705Z",
    "dateUpdated": "2026-10-18T11:22:46.937Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109208 (GCVE-0-2026-109208)

Vulnerability from nvd – Published: 2026-10-17 02:31 – Updated: 2026-10-18 11:12

Title

LearnPress <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' Parameters

Summary

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'quantity (REST) / order_comments (checkout)' parameter in all versions up to, and including, 4.4.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. With guest checkout enabled the attack is fully unauthenticated; with guest checkout disabled, any Subscriber-level user can exploit both vectors through their own checkout.

Severity

7.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-18 11:07 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

Wordfence CNA under the mitre root

CNA scorecard C 65/100 over 2430 records in the last 180 days details

References

9 references

URL	Tags
https://www.wordfence.com/threat-intel/vulnerabil…
https://plugins.trac.wordpress.org/browser/learnp…
https://plugins.trac.wordpress.org/browser/learnp…
https://plugins.trac.wordpress.org/browser/learnp…
https://plugins.trac.wordpress.org/browser/learnp…
https://plugins.trac.wordpress.org/browser/learnp…
https://plugins.trac.wordpress.org/browser/learnp…
https://plugins.trac.wordpress.org/browser/learnp…
https://plugins.trac.wordpress.org/changeset?repo…

Impacted products

1 product

Vendor	Product	Version
thimpress	LearnPress – WordPress LMS Plugin for Create and Sell Online Courses	Affected: 0 , ≤ 4.4.10 (semver)

Credits

daroo

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109208",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-18T11:07:11.982354Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-18T11:12:34.936Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses",
          "vendor": "thimpress",
          "versions": [
            {
              "lessThanOrEqual": "4.4.10",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "daroo"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027quantity (REST) / order_comments (checkout)\u0027 parameter in all versions up to, and including, 4.4.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. With guest checkout enabled the attack is fully unauthenticated; with guest checkout disabled, any Subscriber-level user can exploit both vectors through their own checkout."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-17T02:31:06.356Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4ac1ddf0-9164-45a8-b1dc-e684b1b4b447?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.10/inc/admin/views/meta-boxes/order/content-tab-preview-exports-invoice.php#L86"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.10/inc/rest-api/v1/frontend/class-lp-rest-courses-controller.php#L671"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.10/inc/cart/class-lp-cart.php#L108"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.10/inc/order/class-lp-order.php#L688"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.10/inc/class-lp-checkout.php#L390"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.10/inc/admin/views/meta-boxes/order/details.php#L218"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.10/assets/src/js/admin/order/refund-order.js#L104"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3750024%40learnpress\u0026new=3750024%40learnpress"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-12T13:45:10.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-16T14:28:58.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "LearnPress \u003c= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via \u0027quantity\u0027 and \u0027order_comments\u0027 Parameters"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-109208",
    "datePublished": "2026-10-17T02:31:06.356Z",
    "dateReserved": "2026-10-12T13:29:03.923Z",
    "dateUpdated": "2026-10-18T11:12:34.936Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-104670 (GCVE-0-2026-104670)

Vulnerability from nvd – Published: 2026-10-06 08:35 – Updated: 2026-10-06 10:31

Title

WordPress LearnPress plugin <= 4.4.9 - Cross Site Scripting (XSS) vulnerability

Summary

Unauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 versions.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-06 10:18 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

Patchstack CNA under the mitre root

CNA scorecard B 75/100 over 3528 records in the last 180 days details

References

1 reference

URL	Tags
https://patchstack.com/database/wordpress/plugin/…	vdb-entry

Impacted products

1 product

Vendor	Product	Version
ThimPress	LearnPress	Affected: n/a , ≤ 4.4.9 (custom)

Credits

daroo | Patchstack Bug Bounty Program

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104670",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-06T10:18:13.383576Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-06T10:31:27.439Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "learnpress",
          "product": "LearnPress",
          "vendor": "ThimPress",
          "versions": [
            {
              "changes": [
                {
                  "at": "4.4.9.1",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "4.4.9",
              "status": "affected",
              "version": "n/a",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "daroo | Patchstack Bug Bounty Program"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Unauthenticated Cross Site Scripting (XSS) in LearnPress \u003c= 4.4.9 versions."
            }
          ],
          "value": "Unauthenticated Cross Site Scripting (XSS) in LearnPress \u003c= 4.4.9 versions."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-591",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-591 Reflected XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-06T08:35:16.585Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/learnpress/vulnerability/wordpress-learnpress-plugin-4-4-9-cross-site-scripting-xss-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress LearnPress plugin to the latest available version (at least 4.4.9.1)."
            }
          ],
          "value": "Update the WordPress LearnPress plugin to the latest available version (at least 4.4.9.1)."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "WordPress LearnPress plugin \u003c= 4.4.9 - Cross Site Scripting (XSS) vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-104670",
    "datePublished": "2026-10-06T08:35:16.585Z",
    "dateReserved": "2026-10-02T07:58:39.370Z",
    "dateUpdated": "2026-10-06T10:31:27.439Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-105397 (GCVE-0-2026-105397)

Vulnerability from nvd – Published: 2026-10-05 15:11 – Updated: 2026-10-07 20:48

Title

LearnPress WordPress Plugin through 4.4.9.1 Stored XSS via Quiz Question Hint and Explanation

Summary

LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role can submit unsanitized payloads through the update_question AJAX handler that execute in the session of every student taking the quiz.

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-07 20:48 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7803 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/LearnPress/learnpress/commit/9…	patch
https://plugins.svn.wordpress.org/learnpress/tags…	technical-description
https://plugins.svn.wordpress.org/learnpress/tags…	technical-description
https://wordpress.org/plugins/learnpress/	product
https://www.vulncheck.com/advisories/learnpress-w…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
ThimPress	LearnPress	Affected: 0 , ≤ 4.4.9.1 (custom) cpe:2.3:a:thimpress:learnpress::::::wordpress::*

Date Public

2026-10-05 00:00

Credits

HunterSploit

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-105397",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-07T20:48:25.231345Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-07T20:48:33.216Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "LearnPress",
          "vendor": "ThimPress",
          "versions": [
            {
              "lessThanOrEqual": "4.4.9.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:thimpress:learnpress:*:*:*:*:*:wordpress:*:*",
                  "versionEndIncluding": "4.4.9.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "HunterSploit"
        }
      ],
      "datePublic": "2026-10-05T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role can submit unsanitized payloads through the update_question AJAX handler that execute in the session of every student taking the quiz."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-05T15:11:23.468Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/LearnPress/learnpress/commit/9db279c0d9fd3993430bb9af158658282e9bcee1"
        },
        {
          "name": "Unsanitized hint/explanation write (4.4.9.1)",
          "tags": [
            "technical-description"
          ],
          "url": "https://plugins.svn.wordpress.org/learnpress/tags/4.4.9.1/inc/Ajax/EditQuestionAjax.php"
        },
        {
          "name": "dangerouslySetInnerHTML render sink (4.4.9.1)",
          "tags": [
            "technical-description"
          ],
          "url": "https://plugins.svn.wordpress.org/learnpress/tags/4.4.9.1/assets/src/apps/js/frontend/quiz/components/questions/question.js"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://wordpress.org/plugins/learnpress/"
        },
        {
          "name": "VulnCheck Advisory: LearnPress WordPress Plugin through 4.4.9.1 Stored XSS via Quiz Question Hint and Explanation",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/learnpress-wordpress-plugin-through-4.4.9.1-stored-xss-via-quiz-question-hint-and-explanation"
        }
      ],
      "title": "LearnPress WordPress Plugin through 4.4.9.1 Stored XSS via Quiz Question Hint and Explanation",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-105397",
    "datePublished": "2026-10-05T15:11:23.468Z",
    "dateReserved": "2026-10-05T10:56:23.833Z",
    "dateUpdated": "2026-10-07T20:48:33.216Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92538 (GCVE-0-2026-92538)

Vulnerability from nvd – Published: 2026-10-03 03:25 – Updated: 2026-10-03 15:42

Title

LearnPress <= 4.4.7 - Reflected DOM-Based Cross-Site Scripting via 'orderby' Parameter

Summary

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'orderby' parameter in all versions up to, and including, 4.4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-03 15:33 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

Wordfence CNA under the mitre root

CNA scorecard C 65/100 over 2430 records in the last 180 days details

References

5 references

URL	Tags
https://www.wordfence.com/threat-intel/vulnerabil…
https://plugins.trac.wordpress.org/browser/learnp…
https://plugins.trac.wordpress.org/browser/learnp…
https://plugins.trac.wordpress.org/browser/learnp…
https://plugins.trac.wordpress.org/browser/learnp…

Impacted products

1 product

Vendor	Product	Version
thimpress	LearnPress – WordPress LMS Plugin for Create and Sell Online Courses	Affected: 0 , ≤ 4.4.7 (semver)

Credits

Yuto Hyakumoto

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92538",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-03T15:33:27.410394Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-03T15:42:46.143Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses",
          "vendor": "thimpress",
          "versions": [
            {
              "lessThanOrEqual": "4.4.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Yuto Hyakumoto"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the \u0027orderby\u0027 parameter in all versions up to, and including, 4.4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-03T03:25:45.200Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b011448b-0598-4b9a-b558-d7be13802ebf?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.7/assets/src/js/admin/init-tom-select.js#L219"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.7/inc/admin/views/search-author-field.php#L43"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.7/inc/class-lp-helper.php#L546"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.7/inc/admin/class-lp-admin-assets.php#L74"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-16T13:37:46.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-02T14:37:50.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "LearnPress \u003c= 4.4.7 - Reflected DOM-Based Cross-Site Scripting via \u0027orderby\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-92538",
    "datePublished": "2026-10-03T03:25:45.200Z",
    "dateReserved": "2026-09-16T12:53:48.318Z",
    "dateUpdated": "2026-10-03T15:42:46.143Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-39717 (GCVE-0-2026-39717)

Vulnerability from nvd – Published: 2026-10-02 14:49 – Updated: 2026-10-09 11:33 X_Open Source

Title

WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability

Summary

Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.10.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-02 15:35 UTC

CWE

CWE-862 - Missing Authorization

Assigner

Patchstack CNA under the mitre root

CNA scorecard B 75/100 over 3528 records in the last 180 days details

References

1 reference

URL	Tags
https://patchstack.com/database/wordpress/plugin/…	vdb-entry

Impacted products

1 product

Vendor	Product	Version
ThimPress	LearnPress	Affected: 0 , ≤ 4.4.10 (custom)

Date Public

2026-10-02 14:49

Credits

Ananda Dhakal (Patchstack)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-39717",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-02T15:35:14.803772Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-02T15:35:23.063Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "learnpress",
          "product": "LearnPress",
          "vendor": "ThimPress",
          "versions": [
            {
              "lessThanOrEqual": "4.4.10",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ananda Dhakal (Patchstack)"
        }
      ],
      "datePublic": "2026-10-02T14:49:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects LearnPress: from n/a through 4.4.10.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.10."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-09T11:33:22.679Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/learnpress/vulnerability/wordpress-learnpress-plugin-4-4-9-1-broken-access-control-vulnerability?_s_id=cve"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "WordPress LearnPress plugin \u003c= 4.4.10 - Broken Access Control vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-39717",
    "datePublished": "2026-10-02T14:49:50.614Z",
    "dateReserved": "2026-04-07T10:58:29.177Z",
    "dateUpdated": "2026-10-09T11:33:22.679Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-52713 (GCVE-0-2026-52713)

Vulnerability from cvelistv5 – Published: 2026-11-07 09:03 – Updated: 2026-11-07 18:36 X_Open Source

Title

WordPress LearnPress plugin <= 4.4.12 - Broken Access Control vulnerability

Summary

Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.12.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-07 18:16 UTC

CWE

CWE-862 - Missing Authorization

Assigner

Patchstack CNA under the mitre root

CNA scorecard B 75/100 over 3528 records in the last 180 days details

References

1 reference

URL	Tags
https://patchstack.com/database/wordpress/plugin/…	vdb-entry

Impacted products

1 product

Vendor	Product	Version
ThimPress	LearnPress	Affected: 0 , ≤ 4.4.12 (custom)

Date Public

2026-11-07 09:03

Credits

Alveni | Patchstack Bug Bounty Program

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-52713",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T18:16:57.132531Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T18:36:41.908Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "learnpress",
          "product": "LearnPress",
          "vendor": "ThimPress",
          "versions": [
            {
              "changes": [
                {
                  "at": "4.4.13",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "4.4.12",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Alveni | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-11-07T09:03:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects LearnPress: from n/a through 4.4.12.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.12."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T09:04:32.430Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/learnpress/vulnerability/wordpress-learnpress-plugin-4-4-12-broken-access-control-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress LearnPress plugin to the latest available version (at least 4.4.13)."
            }
          ],
          "value": "Update the WordPress LearnPress plugin to the latest available version (at least 4.4.13)."
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "WordPress LearnPress plugin \u003c= 4.4.12 - Broken Access Control vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-52713",
    "datePublished": "2026-11-07T09:03:26.066Z",
    "dateReserved": "2026-06-08T10:11:21.891Z",
    "dateUpdated": "2026-11-07T18:36:41.908Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-118054 (GCVE-0-2026-118054)

Vulnerability from cvelistv5 – Published: 2026-11-07 02:29 – Updated: 2026-11-07 18:06

Title

LearnPress <= 4.2.2 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'review_title' Parameter

Summary

The LearnPress – Course Review plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'review_title (inside `data.args.review_title`)' parameter in all versions up to, and including, 4.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload only executes after an administrator approves the submitted review, though sites with comment_previously_approved auto-approval configured may bypass manual moderation.

Severity

6.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-07 18:03 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation

Assigner

Wordfence CNA under the mitre root

CNA scorecard C 65/100 over 2430 records in the last 180 days details

References

6 references

URL	Tags
https://www.wordfence.com/threat-intel/vulnerabil…
https://plugins.trac.wordpress.org/browser/learnp…
https://plugins.trac.wordpress.org/browser/learnp…
https://plugins.trac.wordpress.org/browser/learnp…
https://plugins.trac.wordpress.org/browser/learnp…
https://plugins.trac.wordpress.org/browser/learnp…

Impacted products

1 product

Vendor	Product	Version
thimpress	LearnPress – Course Review	Affected: 0 , ≤ 4.2.2 (semver)

Credits

jiahao

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-118054",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T18:03:24.261727Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T18:06:10.042Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "LearnPress \u2013 Course Review",
          "vendor": "thimpress",
          "versions": [
            {
              "lessThanOrEqual": "4.2.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "jiahao"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The LearnPress \u2013 Course Review plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the \u0027review_title (inside `data.args.review_title`)\u0027 parameter in all versions up to, and including, 4.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload only executes after an administrator approves the submitted review, though sites with comment_previously_approved auto-approval configured may bypass manual moderation."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T02:29:11.216Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0f166e2e-6dd5-4453-8448-b7d7905dbf49?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress-course-review/tags/4.2.2/inc/TemplateHooks/CourseRatingTemplate.php#L397"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress-course-review/tags/4.2.2/inc/TemplateHooks/CourseRatingTemplate.php#L640"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress-course-review/tags/4.2.2/inc/load.php#L569"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress-course-review/tags/4.2.2/inc/functions.php#L208"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress-course-review/tags/4.2.3/inc/TemplateHooks/CourseRatingTemplate.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-27T15:42:59.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-11-06T14:09:17.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "LearnPress \u003c= 4.2.2 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via \u0027review_title\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-118054",
    "datePublished": "2026-11-07T02:29:11.216Z",
    "dateReserved": "2026-10-27T15:24:39.784Z",
    "dateUpdated": "2026-11-07T18:06:10.042Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-42690 (GCVE-0-2026-42690)

Vulnerability from cvelistv5 – Published: 2026-10-29 15:23 – Updated: 2026-10-29 17:17

Title

WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability

Summary

Subscriber Broken Access Control in LearnPress <= 4.4.10 versions.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-29 16:15 UTC

CWE

CWE-862 - Missing Authorization

Assigner

Patchstack CNA under the mitre root

CNA scorecard B 75/100 over 3528 records in the last 180 days details

References

1 reference

URL	Tags
https://patchstack.com/database/wordpress/plugin/…	vdb-entry

Impacted products

1 product

Vendor	Product	Version
ThimPress	LearnPress	Affected: n/a , ≤ 4.4.10 (custom)

Credits

Ananda Dhakal (Patchstack) | Patchstack Bug Bounty Program

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42690",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-29T16:15:53.953176Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-29T17:17:08.164Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "learnpress",
          "product": "LearnPress",
          "vendor": "ThimPress",
          "versions": [
            {
              "changes": [
                {
                  "at": "4.4.11",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "4.4.10",
              "status": "affected",
              "version": "n/a",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Ananda Dhakal (Patchstack) | Patchstack Bug Bounty Program"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Subscriber Broken Access Control in LearnPress \u003c= 4.4.10 versions."
            }
          ],
          "value": "Subscriber Broken Access Control in LearnPress \u003c= 4.4.10 versions."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T15:23:58.663Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/learnpress/vulnerability/wordpress-learnpress-plugin-4-4-10-broken-access-control-vulnerability-2?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "No patched version available."
            }
          ],
          "value": "No patched version available."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "WordPress LearnPress plugin \u003c= 4.4.10 - Broken Access Control vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-42690",
    "datePublished": "2026-10-29T15:23:58.663Z",
    "dateReserved": "2026-04-29T09:05:01.790Z",
    "dateUpdated": "2026-10-29T17:17:08.164Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-115599 (GCVE-0-2026-115599)

Vulnerability from cvelistv5 – Published: 2026-10-29 11:00 – Updated: 2026-10-29 12:36 X_Open Source

Title

WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability

Summary

Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.11.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-29 12:18 UTC

CWE

CWE-862 - Missing Authorization

Assigner

Patchstack CNA under the mitre root

CNA scorecard B 75/100 over 3528 records in the last 180 days details

References

1 reference

URL	Tags
https://patchstack.com/database/wordpress/plugin/…	vdb-entry

Impacted products

1 product

Vendor	Product	Version
ThimPress	LearnPress	Affected: 0 , ≤ 4.4.11 (custom)

Date Public

2026-10-27 10:23

Credits

MinKhoy - VinSOC | Patchstack Bug Bounty Program

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-115599",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-29T12:18:31.065282Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-29T12:36:52.417Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "learnpress",
          "product": "LearnPress",
          "vendor": "ThimPress",
          "versions": [
            {
              "changes": [
                {
                  "at": "4.4.12",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "4.4.11",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "MinKhoy - VinSOC | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-10-27T10:23:39.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects LearnPress: from n/a through 4.4.11.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.11."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T11:00:24.169Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/learnpress/vulnerability/wordpress-learnpress-plugin-4-4-11-broken-access-control-vulnerability-3?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress LearnPress plugin to the latest available version (at least 4.4.12)."
            }
          ],
          "value": "Update the WordPress LearnPress plugin to the latest available version (at least 4.4.12)."
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "WordPress LearnPress plugin \u003c= 4.4.11 - Broken Access Control vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-115599",
    "datePublished": "2026-10-29T11:00:24.169Z",
    "dateReserved": "2026-10-23T00:18:53.712Z",
    "dateUpdated": "2026-10-29T12:36:52.417Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-115598 (GCVE-0-2026-115598)

Vulnerability from cvelistv5 – Published: 2026-10-26 16:45 – Updated: 2026-10-26 17:37 X_Open Source

Title

WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability

Summary

Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.11.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-26 17:23 UTC

CWE

CWE-862 - Missing Authorization

Assigner

Patchstack CNA under the mitre root

CNA scorecard B 75/100 over 3528 records in the last 180 days details

References

1 reference

URL	Tags
https://patchstack.com/database/wordpress/plugin/…	vdb-entry

Impacted products

1 product

Vendor	Product	Version
ThimPress	LearnPress	Affected: 0 , ≤ 4.4.11 (custom)

Date Public

2026-10-26 16:44

Credits

ssophiz | Patchstack Bug Bounty Program

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-115598",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-26T17:23:02.331267Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-26T17:37:09.543Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "learnpress",
          "product": "LearnPress",
          "vendor": "ThimPress",
          "versions": [
            {
              "changes": [
                {
                  "at": "4.4.12",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "4.4.11",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "ssophiz | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-10-26T16:44:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects LearnPress: from n/a through 4.4.11.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.11."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-26T16:45:19.394Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/learnpress/vulnerability/wordpress-learnpress-plugin-4-4-11-broken-access-control-vulnerability-2?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress LearnPress plugin to the latest available version (at least 4.4.12)."
            }
          ],
          "value": "Update the WordPress LearnPress plugin to the latest available version (at least 4.4.12)."
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "WordPress LearnPress plugin \u003c= 4.4.11 - Broken Access Control vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-115598",
    "datePublished": "2026-10-26T16:45:11.621Z",
    "dateReserved": "2026-10-23T00:18:53.712Z",
    "dateUpdated": "2026-10-26T17:37:09.543Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-115597 (GCVE-0-2026-115597)

Vulnerability from cvelistv5 – Published: 2026-10-26 16:43 – Updated: 2026-10-26 17:37 X_Open Source

Title

WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability

Summary

Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.11.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-26 17:23 UTC

CWE

CWE-862 - Missing Authorization

Assigner

Patchstack CNA under the mitre root

CNA scorecard B 75/100 over 3528 records in the last 180 days details

References

1 reference

URL	Tags
https://patchstack.com/database/wordpress/plugin/…	vdb-entry

Impacted products

1 product

Vendor	Product	Version
ThimPress	LearnPress	Affected: 0 , ≤ 4.4.11 (custom)

Date Public

2026-10-26 16:43

Credits

Harry Nguyen | Patchstack Bug Bounty Program

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-115597",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-26T17:23:25.354103Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-26T17:37:09.885Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "learnpress",
          "product": "LearnPress",
          "vendor": "ThimPress",
          "versions": [
            {
              "changes": [
                {
                  "at": "4.4.12",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "4.4.11",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Harry Nguyen | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-10-26T16:43:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects LearnPress: from n/a through 4.4.11.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.11."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-26T16:44:22.242Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/learnpress/vulnerability/wordpress-learnpress-plugin-4-4-11-broken-access-control-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress LearnPress plugin to the latest available version (at least 4.4.12)."
            }
          ],
          "value": "Update the WordPress LearnPress plugin to the latest available version (at least 4.4.12)."
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "WordPress LearnPress plugin \u003c= 4.4.11 - Broken Access Control vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-115597",
    "datePublished": "2026-10-26T16:43:22.281Z",
    "dateReserved": "2026-10-23T00:18:53.712Z",
    "dateUpdated": "2026-10-26T17:37:09.885Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-113353 (GCVE-0-2026-113353)

Vulnerability from cvelistv5 – Published: 2026-10-20 10:41 – Updated: 2026-10-20 14:32

Title

LearnPress before 4.4.10 Missing Authorization via Legacy Editor AJAX Handlers

Summary

LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor and admin_question_editor lp-ajax actions, allowing instructors to modify other instructors' content. Authenticated instructors can reuse their own generic editor nonce with another object's id parameter to alter courses, change quiz answers, and trash questions.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-20 14:32 UTC

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7803 records in the last 180 days details

References

6 references

URL	Tags
https://github.com/LearnPress/learnpress/commit/7…	patch
https://plugins.svn.wordpress.org/learnpress/tags…	technical-description
https://plugins.svn.wordpress.org/learnpress/tags…	technical-description
https://learnpresslms.com/changelog/	release-notes
https://wordpress.org/plugins/learnpress/	product
https://www.vulncheck.com/advisories/learnpress-b…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
ThimPress	LearnPress	Affected: 0 , < 4.4.10 (semver) cpe:2.3:a:thimpress:learnpress::::::wordpress::*

Date Public

2026-10-09 01:50

Credits

Trần Văn Hoàng

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-113353",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-20T14:32:42.250134Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-20T14:32:51.446Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "LearnPress",
          "vendor": "ThimPress",
          "versions": [
            {
              "lessThan": "4.4.10",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:thimpress:learnpress:*:*:*:*:*:wordpress:*:*",
                  "versionEndExcluding": "4.4.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Tr\u1ea7n V\u0103n Ho\u00e0ng"
        }
      ],
      "datePublic": "2026-10-09T01:50:25.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor and admin_question_editor lp-ajax actions, allowing instructors to modify other instructors\u0027 content. Authenticated instructors can reuse their own generic editor nonce with another object\u0027s id parameter to alter courses, change quiz answers, and trash questions."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-20T10:41:38.826Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/LearnPress/learnpress/commit/77087dcdc0e974e8d0844453b4071189fc2c70d2"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://plugins.svn.wordpress.org/learnpress/tags/4.4.9.1/inc/admin/editor/class-lp-admin-editor-course.php"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://plugins.svn.wordpress.org/learnpress/tags/4.4.9.1/inc/admin/class-lp-admin-ajax.php"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://learnpresslms.com/changelog/"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://wordpress.org/plugins/learnpress/"
        },
        {
          "name": "VulnCheck Advisory: LearnPress before 4.4.10 Missing Authorization via Legacy Editor AJAX Handlers",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/learnpress-before-4.4.10-missing-authorization-via-legacy-editor-ajax-handlers"
        }
      ],
      "title": "LearnPress before 4.4.10 Missing Authorization via Legacy Editor AJAX Handlers",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-113353",
    "datePublished": "2026-10-20T10:41:38.826Z",
    "dateReserved": "2026-10-20T01:07:46.397Z",
    "dateUpdated": "2026-10-20T14:32:51.446Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-110363 (GCVE-0-2026-110363)

Vulnerability from cvelistv5 – Published: 2026-10-19 12:21 – Updated: 2026-10-19 18:15 X_Open Source

Title

WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability

Summary

Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.10.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-19 18:15 UTC

CWE

CWE-862 - Missing Authorization

Assigner

Patchstack CNA under the mitre root

CNA scorecard B 75/100 over 3528 records in the last 180 days details

References

1 reference

URL	Tags
https://patchstack.com/database/wordpress/plugin/…	vdb-entry

Impacted products

1 product

Vendor	Product	Version
ThimPress	LearnPress	Affected: 0 , ≤ 4.4.10 (custom)

Date Public

2026-10-19 12:21

Credits

MD Mahmidul Hasan | Patchstack Bug Bounty Program

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-110363",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-19T18:15:07.114360Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T18:15:27.691Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "learnpress",
          "product": "LearnPress",
          "vendor": "ThimPress",
          "versions": [
            {
              "changes": [
                {
                  "at": "4.4.11",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "4.4.10",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "MD Mahmidul Hasan | Patchstack Bug Bounty Program"
        }
      ],
      "datePublic": "2026-10-19T12:21:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects LearnPress: from n/a through 4.4.10.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.10."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T12:21:58.945Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/learnpress/vulnerability/wordpress-learnpress-plugin-4-4-10-broken-access-control-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress LearnPress plugin to the latest available version (at least 4.4.11)."
            }
          ],
          "value": "Update the WordPress LearnPress plugin to the latest available version (at least 4.4.11)."
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "WordPress LearnPress plugin \u003c= 4.4.10 - Broken Access Control vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-110363",
    "datePublished": "2026-10-19T12:21:58.494Z",
    "dateReserved": "2026-10-14T00:22:17.448Z",
    "dateUpdated": "2026-10-19T18:15:27.691Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-107744 (GCVE-0-2026-107744)

Vulnerability from cvelistv5 – Published: 2026-10-17 03:43 – Updated: 2026-10-18 11:22

Title

LearnPress <= 4.4.10 - Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via 'search-authors' AJAX Action

Summary

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.10 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to enumerate the complete site user roster and extract the full email address of any WordPress account, including administrator accounts, character-by-character by using the search response as an oracle against both user_login and user_email columns.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-18 11:07 UTC

CWE

CWE-862 - Missing Authorization

Assigner

Wordfence CNA under the mitre root

CNA scorecard C 65/100 over 2430 records in the last 180 days details

References

5 references

URL	Tags
https://www.wordfence.com/threat-intel/vulnerabil…
https://plugins.trac.wordpress.org/browser/learnp…
https://plugins.trac.wordpress.org/browser/learnp…
https://plugins.trac.wordpress.org/browser/learnp…
https://plugins.trac.wordpress.org/changeset/3750…

Impacted products

1 product

Vendor	Product	Version
thimpress	LearnPress – WordPress LMS Plugin for Create and Sell Online Courses	Affected: 0 , ≤ 4.4.10 (semver)

Credits

Kuba

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107744",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-18T11:07:56.529901Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-18T11:22:46.337Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses",
          "vendor": "thimpress",
          "versions": [
            {
              "lessThanOrEqual": "4.4.10",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Kuba"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.10 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to enumerate the complete site user roster and extract the full email address of any WordPress account, including administrator accounts, character-by-character by using the search response as an oracle against both user_login and user_email columns."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-17T03:43:30.064Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d1894596-b430-41b3-9d28-12c7dea7ff9b?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.9.1/inc/admin/class-lp-admin-ajax.php#L105"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.9.1/inc/admin/class-lp-admin-ajax.php#L80"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.9.1/inc/class-lp-request-handler.php#L173"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3750011/learnpress/trunk/inc/admin/class-lp-admin-ajax.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-08T18:40:24.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-16T14:31:20.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "LearnPress \u003c= 4.4.10 - Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via \u0027search-authors\u0027 AJAX Action"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-107744",
    "datePublished": "2026-10-17T03:43:30.064Z",
    "dateReserved": "2026-10-08T18:25:02.823Z",
    "dateUpdated": "2026-10-18T11:22:46.337Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-104736 (GCVE-0-2026-104736)

Vulnerability from cvelistv5 – Published: 2026-10-17 03:43 – Updated: 2026-10-18 11:22

Title

LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter

Summary

The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout-email' request parameter during the checkout AJAX action. The value is passed through sanitize_text_field(), which does not strip serialized object syntax, then stored in the LearnPress session table and later fed to LP_Helper::maybe_unserialize() → unserialize() (without an allowed_classes restriction) by LP_Session_Handler::get() on subsequent requests. This makes it possible for unauthenticated attackers to inject a PHP Object.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-18 11:08 UTC

CWE

CWE-502 - Deserialization of Untrusted Data

Assigner

Wordfence CNA under the mitre root

CNA scorecard C 65/100 over 2430 records in the last 180 days details

References

6 references

URL	Tags
https://www.wordfence.com/threat-intel/vulnerabil…
https://plugins.trac.wordpress.org/browser/learnp…
https://plugins.trac.wordpress.org/browser/learnp…
https://plugins.trac.wordpress.org/browser/learnp…
https://plugins.trac.wordpress.org/browser/learnp…
https://plugins.trac.wordpress.org/changeset?repo…

Impacted products

1 product

Vendor	Product	Version
thimpress	LearnPress – WordPress LMS Plugin for Create and Sell Online Courses	Affected: 0 , ≤ 4.4.10 (semver)

Credits

Wordfence PRISM

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104736",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-18T11:08:40.232447Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-18T11:22:46.937Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses",
          "vendor": "thimpress",
          "versions": [
            {
              "lessThanOrEqual": "4.4.10",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the \u0027checkout-email\u0027 request parameter during the checkout AJAX action. The value is passed through sanitize_text_field(), which does not strip serialized object syntax, then stored in the LearnPress session table and later fed to LP_Helper::maybe_unserialize() \u2192 unserialize() (without an allowed_classes restriction) by LP_Session_Handler::get() on subsequent requests. This makes it possible for unauthenticated attackers to inject a PHP Object."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-17T03:43:28.046Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3e28e008-0ec1-4262-9ac0-6170cf8b8bdf?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.9.1/inc/class-lp-session-handler.php#L373"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.9.1/inc/class-lp-checkout.php#L377"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.9.1/inc/class-lp-checkout.php#L523"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.9.1/inc/class-lp-ajax.php#L21"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3750024%40learnpress\u0026new=3750024%40learnpress"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-02T12:07:17.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-16T14:33:32.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "LearnPress \u003c= 4.4.10 - Unauthenticated PHP Object Injection via \u0027checkout-email\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-104736",
    "datePublished": "2026-10-17T03:43:28.046Z",
    "dateReserved": "2026-10-02T11:52:06.705Z",
    "dateUpdated": "2026-10-18T11:22:46.937Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-109208 (GCVE-0-2026-109208)

Vulnerability from cvelistv5 – Published: 2026-10-17 02:31 – Updated: 2026-10-18 11:12

Title

LearnPress <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' Parameters

Summary

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'quantity (REST) / order_comments (checkout)' parameter in all versions up to, and including, 4.4.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. With guest checkout enabled the attack is fully unauthenticated; with guest checkout disabled, any Subscriber-level user can exploit both vectors through their own checkout.

Severity

7.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-18 11:07 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

Wordfence CNA under the mitre root

CNA scorecard C 65/100 over 2430 records in the last 180 days details

References

9 references

URL	Tags
https://www.wordfence.com/threat-intel/vulnerabil…
https://plugins.trac.wordpress.org/browser/learnp…
https://plugins.trac.wordpress.org/browser/learnp…
https://plugins.trac.wordpress.org/browser/learnp…
https://plugins.trac.wordpress.org/browser/learnp…
https://plugins.trac.wordpress.org/browser/learnp…
https://plugins.trac.wordpress.org/browser/learnp…
https://plugins.trac.wordpress.org/browser/learnp…
https://plugins.trac.wordpress.org/changeset?repo…

Impacted products

1 product

Vendor	Product	Version
thimpress	LearnPress – WordPress LMS Plugin for Create and Sell Online Courses	Affected: 0 , ≤ 4.4.10 (semver)

Credits

daroo

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109208",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-18T11:07:11.982354Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-18T11:12:34.936Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses",
          "vendor": "thimpress",
          "versions": [
            {
              "lessThanOrEqual": "4.4.10",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "daroo"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027quantity (REST) / order_comments (checkout)\u0027 parameter in all versions up to, and including, 4.4.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. With guest checkout enabled the attack is fully unauthenticated; with guest checkout disabled, any Subscriber-level user can exploit both vectors through their own checkout."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-17T02:31:06.356Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4ac1ddf0-9164-45a8-b1dc-e684b1b4b447?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.10/inc/admin/views/meta-boxes/order/content-tab-preview-exports-invoice.php#L86"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.10/inc/rest-api/v1/frontend/class-lp-rest-courses-controller.php#L671"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.10/inc/cart/class-lp-cart.php#L108"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.10/inc/order/class-lp-order.php#L688"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.10/inc/class-lp-checkout.php#L390"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.10/inc/admin/views/meta-boxes/order/details.php#L218"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.10/assets/src/js/admin/order/refund-order.js#L104"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3750024%40learnpress\u0026new=3750024%40learnpress"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-12T13:45:10.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-16T14:28:58.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "LearnPress \u003c= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via \u0027quantity\u0027 and \u0027order_comments\u0027 Parameters"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-109208",
    "datePublished": "2026-10-17T02:31:06.356Z",
    "dateReserved": "2026-10-12T13:29:03.923Z",
    "dateUpdated": "2026-10-18T11:12:34.936Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-104670 (GCVE-0-2026-104670)

Vulnerability from cvelistv5 – Published: 2026-10-06 08:35 – Updated: 2026-10-06 10:31

Title

WordPress LearnPress plugin <= 4.4.9 - Cross Site Scripting (XSS) vulnerability

Summary

Unauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 versions.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-06 10:18 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

Patchstack CNA under the mitre root

CNA scorecard B 75/100 over 3528 records in the last 180 days details

References

1 reference

URL	Tags
https://patchstack.com/database/wordpress/plugin/…	vdb-entry

Impacted products

1 product

Vendor	Product	Version
ThimPress	LearnPress	Affected: n/a , ≤ 4.4.9 (custom)

Credits

daroo | Patchstack Bug Bounty Program

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104670",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-06T10:18:13.383576Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-06T10:31:27.439Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "learnpress",
          "product": "LearnPress",
          "vendor": "ThimPress",
          "versions": [
            {
              "changes": [
                {
                  "at": "4.4.9.1",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "4.4.9",
              "status": "affected",
              "version": "n/a",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "daroo | Patchstack Bug Bounty Program"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Unauthenticated Cross Site Scripting (XSS) in LearnPress \u003c= 4.4.9 versions."
            }
          ],
          "value": "Unauthenticated Cross Site Scripting (XSS) in LearnPress \u003c= 4.4.9 versions."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-591",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-591 Reflected XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-06T08:35:16.585Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/learnpress/vulnerability/wordpress-learnpress-plugin-4-4-9-cross-site-scripting-xss-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update the WordPress LearnPress plugin to the latest available version (at least 4.4.9.1)."
            }
          ],
          "value": "Update the WordPress LearnPress plugin to the latest available version (at least 4.4.9.1)."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "WordPress LearnPress plugin \u003c= 4.4.9 - Cross Site Scripting (XSS) vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-104670",
    "datePublished": "2026-10-06T08:35:16.585Z",
    "dateReserved": "2026-10-02T07:58:39.370Z",
    "dateUpdated": "2026-10-06T10:31:27.439Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-105397 (GCVE-0-2026-105397)

Vulnerability from cvelistv5 – Published: 2026-10-05 15:11 – Updated: 2026-10-07 20:48

Title

LearnPress WordPress Plugin through 4.4.9.1 Stored XSS via Quiz Question Hint and Explanation

Summary

LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role can submit unsanitized payloads through the update_question AJAX handler that execute in the session of every student taking the quiz.

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-07 20:48 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 7803 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/LearnPress/learnpress/commit/9…	patch
https://plugins.svn.wordpress.org/learnpress/tags…	technical-description
https://plugins.svn.wordpress.org/learnpress/tags…	technical-description
https://wordpress.org/plugins/learnpress/	product
https://www.vulncheck.com/advisories/learnpress-w…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
ThimPress	LearnPress	Affected: 0 , ≤ 4.4.9.1 (custom) cpe:2.3:a:thimpress:learnpress::::::wordpress::*

Date Public

2026-10-05 00:00

Credits

HunterSploit

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-105397",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-07T20:48:25.231345Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-07T20:48:33.216Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "LearnPress",
          "vendor": "ThimPress",
          "versions": [
            {
              "lessThanOrEqual": "4.4.9.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:thimpress:learnpress:*:*:*:*:*:wordpress:*:*",
                  "versionEndIncluding": "4.4.9.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "HunterSploit"
        }
      ],
      "datePublic": "2026-10-05T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role can submit unsanitized payloads through the update_question AJAX handler that execute in the session of every student taking the quiz."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-05T15:11:23.468Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/LearnPress/learnpress/commit/9db279c0d9fd3993430bb9af158658282e9bcee1"
        },
        {
          "name": "Unsanitized hint/explanation write (4.4.9.1)",
          "tags": [
            "technical-description"
          ],
          "url": "https://plugins.svn.wordpress.org/learnpress/tags/4.4.9.1/inc/Ajax/EditQuestionAjax.php"
        },
        {
          "name": "dangerouslySetInnerHTML render sink (4.4.9.1)",
          "tags": [
            "technical-description"
          ],
          "url": "https://plugins.svn.wordpress.org/learnpress/tags/4.4.9.1/assets/src/apps/js/frontend/quiz/components/questions/question.js"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://wordpress.org/plugins/learnpress/"
        },
        {
          "name": "VulnCheck Advisory: LearnPress WordPress Plugin through 4.4.9.1 Stored XSS via Quiz Question Hint and Explanation",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/learnpress-wordpress-plugin-through-4.4.9.1-stored-xss-via-quiz-question-hint-and-explanation"
        }
      ],
      "title": "LearnPress WordPress Plugin through 4.4.9.1 Stored XSS via Quiz Question Hint and Explanation",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-105397",
    "datePublished": "2026-10-05T15:11:23.468Z",
    "dateReserved": "2026-10-05T10:56:23.833Z",
    "dateUpdated": "2026-10-07T20:48:33.216Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92538 (GCVE-0-2026-92538)

Vulnerability from cvelistv5 – Published: 2026-10-03 03:25 – Updated: 2026-10-03 15:42

Title

LearnPress <= 4.4.7 - Reflected DOM-Based Cross-Site Scripting via 'orderby' Parameter

Summary

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'orderby' parameter in all versions up to, and including, 4.4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-03 15:33 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

Wordfence CNA under the mitre root

CNA scorecard C 65/100 over 2430 records in the last 180 days details

References

5 references

URL	Tags
https://www.wordfence.com/threat-intel/vulnerabil…
https://plugins.trac.wordpress.org/browser/learnp…
https://plugins.trac.wordpress.org/browser/learnp…
https://plugins.trac.wordpress.org/browser/learnp…
https://plugins.trac.wordpress.org/browser/learnp…

Impacted products

1 product

Vendor	Product	Version
thimpress	LearnPress – WordPress LMS Plugin for Create and Sell Online Courses	Affected: 0 , ≤ 4.4.7 (semver)

Credits

Yuto Hyakumoto

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92538",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-03T15:33:27.410394Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-03T15:42:46.143Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses",
          "vendor": "thimpress",
          "versions": [
            {
              "lessThanOrEqual": "4.4.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Yuto Hyakumoto"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the \u0027orderby\u0027 parameter in all versions up to, and including, 4.4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-03T03:25:45.200Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b011448b-0598-4b9a-b558-d7be13802ebf?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.7/assets/src/js/admin/init-tom-select.js#L219"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.7/inc/admin/views/search-author-field.php#L43"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.7/inc/class-lp-helper.php#L546"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.7/inc/admin/class-lp-admin-assets.php#L74"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-16T13:37:46.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-02T14:37:50.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "LearnPress \u003c= 4.4.7 - Reflected DOM-Based Cross-Site Scripting via \u0027orderby\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-92538",
    "datePublished": "2026-10-03T03:25:45.200Z",
    "dateReserved": "2026-09-16T12:53:48.318Z",
    "dateUpdated": "2026-10-03T15:42:46.143Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-39717 (GCVE-0-2026-39717)

Vulnerability from cvelistv5 – Published: 2026-10-02 14:49 – Updated: 2026-10-09 11:33 X_Open Source

Title

WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability

Summary

Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.10.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-02 15:35 UTC

CWE

CWE-862 - Missing Authorization

Assigner

Patchstack CNA under the mitre root

CNA scorecard B 75/100 over 3528 records in the last 180 days details

References

1 reference

URL	Tags
https://patchstack.com/database/wordpress/plugin/…	vdb-entry

Impacted products

1 product

Vendor	Product	Version
ThimPress	LearnPress	Affected: 0 , ≤ 4.4.10 (custom)

Date Public

2026-10-02 14:49

Credits

Ananda Dhakal (Patchstack)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-39717",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-02T15:35:14.803772Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-02T15:35:23.063Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "learnpress",
          "product": "LearnPress",
          "vendor": "ThimPress",
          "versions": [
            {
              "lessThanOrEqual": "4.4.10",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ananda Dhakal (Patchstack)"
        }
      ],
      "datePublic": "2026-10-02T14:49:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects LearnPress: from n/a through 4.4.10.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.10."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-09T11:33:22.679Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/wordpress/plugin/learnpress/vulnerability/wordpress-learnpress-plugin-4-4-9-1-broken-access-control-vulnerability?_s_id=cve"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "title": "WordPress LearnPress plugin \u003c= 4.4.10 - Broken Access Control vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2026-39717",
    "datePublished": "2026-10-02T14:49:50.614Z",
    "dateReserved": "2026-04-07T10:58:29.177Z",
    "dateUpdated": "2026-10-09T11:33:22.679Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

311 vulnerabilities by ThimPress

CVE-2026-52713 (GCVE-0-2026-52713)

CVE-2026-118054 (GCVE-0-2026-118054)

CVE-2026-42690 (GCVE-0-2026-42690)

CVE-2026-115599 (GCVE-0-2026-115599)

CVE-2026-115598 (GCVE-0-2026-115598)

CVE-2026-115597 (GCVE-0-2026-115597)

CVE-2026-113353 (GCVE-0-2026-113353)

CVE-2026-110363 (GCVE-0-2026-110363)

CVE-2026-107744 (GCVE-0-2026-107744)

CVE-2026-104736 (GCVE-0-2026-104736)

CVE-2026-109208 (GCVE-0-2026-109208)

CVE-2026-104670 (GCVE-0-2026-104670)

CVE-2026-105397 (GCVE-0-2026-105397)

CVE-2026-92538 (GCVE-0-2026-92538)

CVE-2026-39717 (GCVE-0-2026-39717)

CVE-2026-52713 (GCVE-0-2026-52713)

CVE-2026-118054 (GCVE-0-2026-118054)

CVE-2026-42690 (GCVE-0-2026-42690)

CVE-2026-115599 (GCVE-0-2026-115599)

CVE-2026-115598 (GCVE-0-2026-115598)

CVE-2026-115597 (GCVE-0-2026-115597)

CVE-2026-113353 (GCVE-0-2026-113353)

CVE-2026-110363 (GCVE-0-2026-110363)

CVE-2026-107744 (GCVE-0-2026-107744)

CVE-2026-104736 (GCVE-0-2026-104736)

CVE-2026-109208 (GCVE-0-2026-109208)

CVE-2026-104670 (GCVE-0-2026-104670)

CVE-2026-105397 (GCVE-0-2026-105397)

CVE-2026-92538 (GCVE-0-2026-92538)

CVE-2026-39717 (GCVE-0-2026-39717)