VibeThemes

Records33All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical15CVSS 9.0–10.0

CVSS high15CVSS 7.0–8.9

Exploited now

VibeThemes records in CISA KEV

No VibeThemes vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Wordpress Learning Management System 21 records HIGH Vslider 2 records LOW Bp Social Connect 1 record MEDIUM Wordpress Learning Management System 1 record MEDIUM

Records

33 records

TI-2024-09698 CVE-2024-10470 · GHSA-pqm3-x6xp-m28q

WPLMS Learning Management System for WordPress <= 4.962 - Unauthenticated Arbitrary File Read and Deletion

HIGH 74

The WPLMS Learning Management System for WordPress, WordPress LMS theme for WordPress is vulnerable to arbitrary file read and deletion due to insufficient file path validation and permissions checks in the readfile and…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.34795 Published 2024-11-09 No fix listed CWE-22

TI-2023-02532 CVE-2023-2704 · GHSA-8prx-vw4f-9q7p

BP Social Connect <= 1.5 - Authentication Bypass

MEDIUM 52

The BP Social Connect plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.5.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01623 Published 2023-05-19 No fix listed CWE-288

TI-2024-37082 CVE-2024-56046 · GHSA-4g88-vp7j-rp6x

WordPress WPLMS plugin <= 1.9.9 - Unauthenticated Arbitrary File Upload vulnerability

MEDIUM 50

Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through <= 1.9.9.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00753 Published 2024-12-31 No fix listed CWE-434

TI-2024-37080 CVE-2024-56044 · GHSA-cwhj-q4fp-695v

WordPress WPLMS plugin <= 1.9.9 - Unauthenticated Arbitrary User Token Generation vulnerability

MEDIUM 50

Authentication Bypass Using an Alternate Path or Channel vulnerability in VibeThemes WPLMS wplms_plugin allows Authentication Bypass.This issue affects WPLMS: from n/a through <= 1.9.9.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00836 Published 2024-12-31 No fix listed CWE-288

TI-2024-37079 CVE-2024-56043 · GHSA-2jp3-2vfh-535w

WordPress WPLMS plugin <= 1.9.9 - Unauthenticated Privilege Escalation vulnerability

MEDIUM 50

Incorrect Privilege Assignment vulnerability in VibeThemes WPLMS wplms_plugin allows Privilege Escalation.This issue affects WPLMS: from n/a through <= 1.9.9.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00622 Published 2024-12-31 No fix listed CWE-266

TI-2024-37076 CVE-2024-56040 · GHSA-c5fr-pjj5-9857

WordPress VibeBP plugin <= 1.9.9.4.1 - Unauthenticated Privilege Escalation vulnerability

MEDIUM 50

Incorrect Privilege Assignment vulnerability in VibeThemes VibeBP vibebp allows Privilege Escalation.This issue affects VibeBP: from n/a through <= 1.9.9.4.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00755 Published 2024-12-31 No fix listed CWE-266

TI-2024-37078 CVE-2024-56042 · GHSA-pph7-qgw4-5mjg

WordPress WPLMS plugin < 1.9.9.5.3 - Unauthenticated SQL Injection vulnerability

MEDIUM 49

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows SQL Injection.This issue affects WPLMS: from n/a through < 1.9.9.5.3.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00697 Published 2024-12-31 No fix listed CWE-89

TI-2024-37081 CVE-2024-56045 · GHSA-pq8x-v483-w8hj

WordPress WPLMS plugin < 1.9.9.5 - Unauthenticated Arbitrary Directory Deletion vulnerability

MEDIUM 47

Path Traversal: '.../...//' vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through < 1.9.9.5.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.00705 Published 2024-12-31 No fix listed CWE-35

TI-2024-37075 CVE-2024-56039 · GHSA-r55v-gf2r-mcgv

WordPress VibeBP plugin < 1.9.9.7.7 - Unauthenticated SQL Injection vulnerability

MEDIUM 47

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes VibeBP vibebp allows SQL Injection.This issue affects VibeBP: from n/a through < 1.9.9.7.7.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.00606 Published 2024-12-31 No fix listed CWE-89

TI-2026-69943 CVE-2026-96327 · GHSA-7wf8-p84v-8jfr

SQL injection in WordPress WPLMS plugin allows blind attacks

MEDIUM 46

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows Blind SQL Injection.This issue affects WPLMS: from n/a before 1.9.9.8.2.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.00243 Published 2026-10-09 Fixed in 1.9.9.8.2 CWE-89

TI-2025-42551 CVE-2025-69097 · GHSA-pwgm-2hr2-pwcx

WordPress WPLMS plugin <= 1.9.9.5.4 - Arbitrary File Deletion vulnerability

MEDIUM 44

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through <= 1.9.9.5.4.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00531 Published 2026-01-22 No fix listed CWE-22

TI-2024-37093 CVE-2024-56057 · GHSA-gxjw-49fg-j678

WordPress WPLMS plugin < 1.9.9.5.2 - Arbitrary File Upload vulnerability

MEDIUM 44

Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through < 1.9.9.5.2.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00557 Published 2024-12-18 No fix listed CWE-434

TI-2024-37088 CVE-2024-56052 · GHSA-f9jf-77vp-42qf

WordPress WPLMS plugin < 1.9.9.5.2 - Student+ Arbitrary File Upload vulnerability

MEDIUM 44

Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through < 1.9.9.5.2.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00691 Published 2024-12-18 No fix listed CWE-434

TI-2024-37086 CVE-2024-56050 · GHSA-hw6x-c383-cw53

WordPress WPLMS plugin < 1.9.9.5.3 - Subscriber+ Arbitrary File Upload vulnerability

MEDIUM 44

Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through < 1.9.9.5.3.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00691 Published 2024-12-18 No fix listed CWE-434

TI-2025-36336 CVE-2025-58668 · GHSA-2v89-xfcg-m2p4

WordPress WPLMS theme <= 4.970 - Broken Access Control vulnerability

MEDIUM 42

Missing Authorization vulnerability in VibeThemes WPLMS wplms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPLMS : from n/a through <= 4.970.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00289 Published 2025-09-22 No fix listed CWE-862

TI-2024-37090 CVE-2024-56054 · GHSA-g5gm-gv27-ppj9

WordPress WPLMS plugin < 1.9.9.5.2 - Instructor+ Arbitrary File Upload vulnerability

MEDIUM 42

Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through < 1.9.9.5.2.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00584 Published 2024-12-18 No fix listed CWE-434

TI-2015-08067 CVE-2015-10139 · GHSA-frrx-jc6h-v2mw

WPLMS Learning Management System for WordPress, WordPress LMS <= 1.8.4.1 - Privilege Escalation

MEDIUM 42

The WPLMS theme for WordPress is vulnerable to Privilege Escalation in versions 1.5.2 to 1.8.4.1 via the 'wp_ajax_import_data' AJAX action.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0184 Published 2025-07-19 No fix listed CWE-269

TI-2024-37084 CVE-2024-56048 · GHSA-2qgq-6952-hvw2

WordPress WPLMS plugin <= 1.9.9 - Arbitrary Option Update to Privilege Escalation vulnerability

MEDIUM 41

Missing Authorization vulnerability in VibeThemes WPLMS wplms_plugin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPLMS: from n/a through <= 1.9.9.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00602 Published 2024-12-18 No fix listed CWE-862

TI-2024-37087 CVE-2024-56051 · GHSA-3px7-9cxh-c3q3

WordPress WPLMS plugin < 1.9.9.5 - Student+ Remote Code Execution (RCE) vulnerability

MEDIUM 40

Improper Control of Generation of Code ('Code Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows Code Injection.This issue affects WPLMS: from n/a through < 1.9.9.5.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00463 Published 2024-12-18 No fix listed CWE-94

TI-2025-31840 CVE-2025-49925 · GHSA-p4vh-4wvr-q953

WordPress WPLMS plugin <= 1.9.9.7 - Broken Access Control vulnerability

LOW 39

Missing Authorization vulnerability in VibeThemes WPLMS wplms_plugin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPLMS: from n/a through <= 1.9.9.7.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00365 Published 2025-10-22 No fix listed CWE-862

TI-2024-37091 CVE-2024-56055 · GHSA-5vpp-fv65-gw43

WordPress WPLMS plugin < 1.9.9.5.2 - Arbitrary Directory Deletion vulnerability

LOW 39

Path Traversal: '.../...//' vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through < 1.9.9.5.2.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00482 Published 2024-12-18 No fix listed CWE-35

TI-2024-37083 CVE-2024-56047 · GHSA-jj38-rj6q-93vp

WordPress WPLMS plugin < 1.9.9.5.3 - Subscriber+ SQL Injection vulnerability

LOW 39

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0062 Published 2024-12-18 No fix listed CWE-89

TI-2024-37089 CVE-2024-56053 · GHSA-q43h-jgq8-r4q8

WordPress WPLMS plugin < 1.9.9.5.3 - Instructor+ SQL Injection vulnerability

LOW 38

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00437 Published 2024-12-18 No fix listed CWE-89

TI-2023-18505 CVE-2023-36690 · GHSA-chvp-wh85-xq46

WordPress WPLMS Theme < 4.900 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in VibeThemes WPLMS theme <= 4.900 versions.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.003 Published 2023-07-11 Fixed in 4.900 CWE-352

TI-2023-08847 CVE-2023-22672 · GHSA-5m6m-75cp-m4vp

WordPress vSlider Multi Image Slider for WordPress Plugin <= 4.1.2 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in Mr.Vibe vSlider Multi Image Slider for WordPress plugin <= 4.1.2 versions.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00256 Published 2023-07-17 No fix listed CWE-352

Open these records in search →