Vulnerabilities

TI-2025-39183 CVE-2025-63035 · GHSA-6gcq-5wh5-5c2g

WordPress WPLMS plugin <= 1.9.9.5.4 - Cross Site Scripting (XSS) vulnerability

LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VibeThemes WPLMS wplms_plugin allows DOM-Based XSS.This issue affects WPLMS: from n/a through <= 1.9.9.5.4.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00196 Published 2025-12-09 No fix listed CWE-79

TI-2025-33366 CVE-2025-53420 · GHSA-mwv4-92pg-p26m

WordPress WPLMS plugin <= 1.9.9.8 - Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VibeThemes WPLMS wplms_plugin allows Reflected XSS.This issue affects WPLMS: from n/a through <= 1.9.9.8.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.0025 Published 2025-10-22 No fix listed CWE-79

TI-2025-31840 CVE-2025-49925 · GHSA-p4vh-4wvr-q953

WordPress WPLMS plugin <= 1.9.9.7 - Broken Access Control vulnerability

LOW 39

Missing Authorization vulnerability in VibeThemes WPLMS wplms_plugin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPLMS: from n/a through <= 1.9.9.7.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00365 Published 2025-10-22 No fix listed CWE-862

TI-2025-36336 CVE-2025-58668 · GHSA-2v89-xfcg-m2p4

WordPress WPLMS theme <= 4.970 - Broken Access Control vulnerability

MEDIUM 42

Missing Authorization vulnerability in VibeThemes WPLMS wplms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPLMS : from n/a through <= 4.970.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00289 Published 2025-09-22 No fix listed CWE-862

TI-2024-37081 CVE-2024-56045 · GHSA-pq8x-v483-w8hj

WordPress WPLMS plugin < 1.9.9.5 - Unauthenticated Arbitrary Directory Deletion vulnerability

MEDIUM 47

Path Traversal: '.../...//' vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through < 1.9.9.5.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.00705 Published 2024-12-31 No fix listed CWE-35

TI-2024-37080 CVE-2024-56044 · GHSA-cwhj-q4fp-695v

WordPress WPLMS plugin <= 1.9.9 - Unauthenticated Arbitrary User Token Generation vulnerability

MEDIUM 50

Authentication Bypass Using an Alternate Path or Channel vulnerability in VibeThemes WPLMS wplms_plugin allows Authentication Bypass.This issue affects WPLMS: from n/a through <= 1.9.9.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00836 Published 2024-12-31 No fix listed CWE-288

TI-2024-37079 CVE-2024-56043 · GHSA-2jp3-2vfh-535w

WordPress WPLMS plugin <= 1.9.9 - Unauthenticated Privilege Escalation vulnerability

MEDIUM 50

Incorrect Privilege Assignment vulnerability in VibeThemes WPLMS wplms_plugin allows Privilege Escalation.This issue affects WPLMS: from n/a through <= 1.9.9.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00622 Published 2024-12-31 No fix listed CWE-266

TI-2024-37078 CVE-2024-56042 · GHSA-pph7-qgw4-5mjg

WordPress WPLMS plugin < 1.9.9.5.3 - Unauthenticated SQL Injection vulnerability

MEDIUM 49

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows SQL Injection.This issue affects WPLMS: from n/a through < 1.9.9.5.3.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00697 Published 2024-12-31 No fix listed CWE-89

TI-2024-37082 CVE-2024-56046 · GHSA-4g88-vp7j-rp6x

WordPress WPLMS plugin <= 1.9.9 - Unauthenticated Arbitrary File Upload vulnerability

MEDIUM 50

Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through <= 1.9.9.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00753 Published 2024-12-31 No fix listed CWE-434

TI-2024-37083 CVE-2024-56047 · GHSA-jj38-rj6q-93vp

WordPress WPLMS plugin < 1.9.9.5.3 - Subscriber+ SQL Injection vulnerability

LOW 39

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows SQL Injection.This issue affects WPLMS: from n/a through < 1.9.9.5.3.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0062 Published 2024-12-18 No fix listed CWE-89

TI-2024-37089 CVE-2024-56053 · GHSA-q43h-jgq8-r4q8

WordPress WPLMS plugin < 1.9.9.5.3 - Instructor+ SQL Injection vulnerability

LOW 38

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows SQL Injection.This issue affects WPLMS: from n/a through < 1.9.9.5.3.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00437 Published 2024-12-18 No fix listed CWE-89

TI-2024-37084 CVE-2024-56048 · GHSA-2qgq-6952-hvw2

WordPress WPLMS plugin <= 1.9.9 - Arbitrary Option Update to Privilege Escalation vulnerability

MEDIUM 41

Missing Authorization vulnerability in VibeThemes WPLMS wplms_plugin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPLMS: from n/a through <= 1.9.9.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00602 Published 2024-12-18 No fix listed CWE-862

TI-2024-37086 CVE-2024-56050 · GHSA-hw6x-c383-cw53

WordPress WPLMS plugin < 1.9.9.5.3 - Subscriber+ Arbitrary File Upload vulnerability

MEDIUM 44

Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through < 1.9.9.5.3.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00691 Published 2024-12-18 No fix listed CWE-434

TI-2024-37088 CVE-2024-56052 · GHSA-f9jf-77vp-42qf

WordPress WPLMS plugin < 1.9.9.5.2 - Student+ Arbitrary File Upload vulnerability

MEDIUM 44

Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through < 1.9.9.5.2.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00691 Published 2024-12-18 No fix listed CWE-434

TI-2024-37090 CVE-2024-56054 · GHSA-g5gm-gv27-ppj9

WordPress WPLMS plugin < 1.9.9.5.2 - Instructor+ Arbitrary File Upload vulnerability

MEDIUM 42

Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through < 1.9.9.5.2.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00584 Published 2024-12-18 No fix listed CWE-434

TI-2024-37093 CVE-2024-56057 · GHSA-gxjw-49fg-j678

WordPress WPLMS plugin < 1.9.9.5.2 - Arbitrary File Upload vulnerability

MEDIUM 44

Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through < 1.9.9.5.2.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00557 Published 2024-12-18 No fix listed CWE-434

TI-2024-37085 CVE-2024-56049 · GHSA-mrp4-383m-m7cq

WordPress WPLMS plugin < 1.9.9.5.2 - Subscriber+ Arbitrary File Deletion vulnerability

LOW 37

Path Traversal: '.../...//' vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through < 1.9.9.5.2.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00469 Published 2024-12-18 No fix listed CWE-35

TI-2024-37091 CVE-2024-56055 · GHSA-5vpp-fv65-gw43

WordPress WPLMS plugin < 1.9.9.5.2 - Arbitrary Directory Deletion vulnerability

LOW 39

Path Traversal: '.../...//' vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through < 1.9.9.5.2.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00482 Published 2024-12-18 No fix listed CWE-35

TI-2024-37087 CVE-2024-56051 · GHSA-3px7-9cxh-c3q3

WordPress WPLMS plugin < 1.9.9.5 - Student+ Remote Code Execution (RCE) vulnerability

MEDIUM 40

Improper Control of Generation of Code ('Code Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows Code Injection.This issue affects WPLMS: from n/a through < 1.9.9.5.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00463 Published 2024-12-18 No fix listed CWE-94

TI-2024-09698 CVE-2024-10470 · GHSA-pqm3-x6xp-m28q

WPLMS Learning Management System for WordPress <= 4.962 - Unauthenticated Arbitrary File Read and Deletion

HIGH 74

The WPLMS Learning Management System for WordPress, WordPress LMS theme for WordPress is vulnerable to arbitrary file read and deletion due to insufficient file path validation and permissions checks in the readfile and…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.34795 Published 2024-11-09 No fix listed CWE-22

TI-2023-18505 CVE-2023-36690 · GHSA-chvp-wh85-xq46

WordPress WPLMS Theme < 4.900 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in VibeThemes WPLMS theme <= 4.900 versions.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.003 Published 2023-07-11 Fixed in 4.900 CWE-352

Vulnerabilities

Filters