Vulnerability history

Authenticated (Subscriber+) Payment Bypass to Free Course Enrollment vulnerability

Missing Authorization to Unauthenticated Arbitrary Quiz Answer Deletion vulnerability

Authenticated (Contributor+) Stored Cross-Site Scripting via 'skin' Shortcode Attribute vulnerability

Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Answer Deletion vulnerability

Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Notification Triggering vulnerability

Admin+ Stored XSS vulnerability

WordPress LearnPress - WordPress LMS Plugin plugin <= 4.3.2.4 - Missing Authorization to Unauthenticated Sensitive User Information Disclosure via REST API vulnerability

WordPress LearnPress - WordPress LMS Plugin plugin <= 4.3.2.2 - Insecure Direct Object Reference to Authenticated (Instructor+) Teacher Material Deletion vulnerability

Missing Authentication to Unauthenticated Course Modification vulnerability

Authenticated (Subscriber+) Stored Cross-Site Scripting via get_profile_social vulnerability

Missing Authorization to Unauthenticated Orders Statistics Exposure vulnerability

Broken Access Control vulnerability

Missing Authorization to Unauthenticated Arbitrary Callback Execution to Information Exposure vulnerability

Cross Site Scripting (XSS) vulnerability

Missing Authorization to Unauthenticated Database Table Manipulation vulnerability

Admin+ Stored XSS vulnerability

Broken Access Control vulnerability

Authenticated (Admin+) Stored Cross-Site Scripting vulnerability

Authenticated (Instructor+) Stored Cross-Site Scripting via Lesson Name vulnerability

Open Redirection vulnerability

Admin+ Stored XSS vulnerability

Course Material Sensitive Information Exposure via REST API vulnerability

Unauthenticated SQL Injection via 'c_only_fields' vulnerability

Unauthenticated SQL Injection via 'c_fields' vulnerability

Authenticated (Contributor+) SQL Injection via order Parameter vulnerability

Insecure Direct Object References (IDOR) vulnerability

Cross Site Request Forgery (CSRF) vulnerability

Authenticated (Contributor+) Local File Inclusion vulnerability

Missing Authorization to Unauthenticated User Registration Bypass vulnerability

Unauthenticated Bypass to User Registration vulnerability

Basic Information Disclosure via JSON API vulnerability

Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter vulnerability

Authenticated (Contributor+) Stored Cross-Site Scripting via layout_html Parameter vulnerability

Unauthenticated Bypass to User Registration vulnerability

Unauthenticated Time-Based SQL Injection vulnerability

Authenticated (Instructor+) Arbitrary File Upload vulnerability

Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Cross-Site Request Forgery to Privilege Escalation vulnerability

Authenticated(LP Instructor+) Stored Cross-Site Scripting vulnerability

Insecure Direct Object Reference vulnerability

Command Injection vulnerability

Insecure Direct Object Reference to Information Disclosure vulnerability

Unauthenticated SQL Injection via order_by vulnerability

Reflected Cross-Site Scripting via add_internal_scripts_to_head vulnerability

Authenticated Broken Access Control vulnerability

Unauthenticated Broken Access Control vulnerability

Auth. SQL Injection (SQLi) vulnerability

Local File Inclusion

Unauthenticated SQL Injection Vulnerability

Unauthenticated PHP Object Injection vulnerability

Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting (XSS) vulnerability

Arbitrary Image Renaming vulnerability

SQL Injection (SQLi) vulnerability

Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Multiple Stored Cross-Site Scripting (XSS) vulnerabilities

Reflected Cross-Site Scripting (XSS) vulnerability

Authenticated Time Based Blind SQL Injection (SQLi) vulnerability

Privilege Escalation vulnerability

Authenticated Page Creation and Status Modification vulnerability

Privilege Escalation vulnerability