Vulnerabilities

TI-2026-69939 CVE-2026-95607 · GHSA-v9qm-r7hh-x8jh

Blind SQL injection in WordPress WPLMS theme

LOW 36

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms allows Blind SQL Injection.This issue affects WPLMS : from n/a through 4.973.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00205 Published 2026-10-09 No fix listed CWE-89

TI-2026-69943 CVE-2026-96327 · GHSA-7wf8-p84v-8jfr

SQL injection in WordPress WPLMS plugin allows blind attacks

MEDIUM 46

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows Blind SQL Injection.This issue affects WPLMS: from n/a before 1.9.9.8.2.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.00243 Published 2026-10-09 Fixed in 1.9.9.8.2 CWE-89

TI-2026-67934 CVE-2026-39722 · GHSA-grrh-97jf-4hx2

WPLMS theme for WordPress: Unauthenticated Reflected Cross-Site Scripting

LOW 31

Unauthenticated Cross Site Scripting (XSS) in WPLMS <= 4.972 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00237 Published 2026-10-06 No fix listed CWE-79

TI-2025-42551 CVE-2025-69097 · GHSA-pwgm-2hr2-pwcx

WordPress WPLMS plugin <= 1.9.9.5.4 - Arbitrary File Deletion vulnerability

MEDIUM 44

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through <= 1.9.9.5.4.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00531 Published 2026-01-22 No fix listed CWE-22

TI-2025-39183 CVE-2025-63035 · GHSA-6gcq-5wh5-5c2g

WordPress WPLMS plugin <= 1.9.9.5.4 - Cross Site Scripting (XSS) vulnerability

LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VibeThemes WPLMS wplms_plugin allows DOM-Based XSS.This issue affects WPLMS: from n/a through <= 1.9.9.5.4.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00196 Published 2025-12-09 No fix listed CWE-79

TI-2025-33366 CVE-2025-53420 · GHSA-mwv4-92pg-p26m

WordPress WPLMS plugin <= 1.9.9.8 - Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VibeThemes WPLMS wplms_plugin allows Reflected XSS.This issue affects WPLMS: from n/a through <= 1.9.9.8.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.0025 Published 2025-10-22 No fix listed CWE-79

TI-2025-31840 CVE-2025-49925 · GHSA-p4vh-4wvr-q953

WordPress WPLMS plugin <= 1.9.9.7 - Broken Access Control vulnerability

LOW 39

Missing Authorization vulnerability in VibeThemes WPLMS wplms_plugin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPLMS: from n/a through <= 1.9.9.7.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00365 Published 2025-10-22 No fix listed CWE-862

TI-2025-36336 CVE-2025-58668 · GHSA-2v89-xfcg-m2p4

WordPress WPLMS theme <= 4.970 - Broken Access Control vulnerability

MEDIUM 42

Missing Authorization vulnerability in VibeThemes WPLMS wplms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPLMS : from n/a through <= 4.970.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00289 Published 2025-09-22 No fix listed CWE-862

TI-2015-08067 CVE-2015-10139 · GHSA-frrx-jc6h-v2mw

WPLMS Learning Management System for WordPress, WordPress LMS <= 1.8.4.1 - Privilege Escalation

MEDIUM 42

The WPLMS theme for WordPress is vulnerable to Privilege Escalation in versions 1.5.2 to 1.8.4.1 via the 'wp_ajax_import_data' AJAX action.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0184 Published 2025-07-19 No fix listed CWE-269

TI-2025-23558 CVE-2025-32493 · GHSA-m6f3-8qqf-55g7

WordPress BP Social Connect plugin <= 1.6.2 - Cross Site Scripting (XSS) Vulnerability

LOW 27

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VibeThemes BP Social Connect bp-social-connect allows Stored XSS.This issue affects BP Social Connect: from n/a throug…

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00376 Published 2025-04-09 No fix listed CWE-79

TI-2024-37081 CVE-2024-56045 · GHSA-pq8x-v483-w8hj

WordPress WPLMS plugin < 1.9.9.5 - Unauthenticated Arbitrary Directory Deletion vulnerability

MEDIUM 47

Path Traversal: '.../...//' vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through < 1.9.9.5.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.00705 Published 2024-12-31 No fix listed CWE-35

TI-2024-37080 CVE-2024-56044 · GHSA-cwhj-q4fp-695v

WordPress WPLMS plugin <= 1.9.9 - Unauthenticated Arbitrary User Token Generation vulnerability

MEDIUM 50

Authentication Bypass Using an Alternate Path or Channel vulnerability in VibeThemes WPLMS wplms_plugin allows Authentication Bypass.This issue affects WPLMS: from n/a through <= 1.9.9.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00836 Published 2024-12-31 No fix listed CWE-288

TI-2024-37079 CVE-2024-56043 · GHSA-2jp3-2vfh-535w

WordPress WPLMS plugin <= 1.9.9 - Unauthenticated Privilege Escalation vulnerability

MEDIUM 50

Incorrect Privilege Assignment vulnerability in VibeThemes WPLMS wplms_plugin allows Privilege Escalation.This issue affects WPLMS: from n/a through <= 1.9.9.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00622 Published 2024-12-31 No fix listed CWE-266

TI-2024-37076 CVE-2024-56040 · GHSA-c5fr-pjj5-9857

WordPress VibeBP plugin <= 1.9.9.4.1 - Unauthenticated Privilege Escalation vulnerability

MEDIUM 50

Incorrect Privilege Assignment vulnerability in VibeThemes VibeBP vibebp allows Privilege Escalation.This issue affects VibeBP: from n/a through <= 1.9.9.4.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00755 Published 2024-12-31 No fix listed CWE-266

TI-2024-37078 CVE-2024-56042 · GHSA-pph7-qgw4-5mjg

WordPress WPLMS plugin < 1.9.9.5.3 - Unauthenticated SQL Injection vulnerability

MEDIUM 49

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows SQL Injection.This issue affects WPLMS: from n/a through < 1.9.9.5.3.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00697 Published 2024-12-31 No fix listed CWE-89

TI-2024-37077 CVE-2024-56041 · GHSA-9mw4-c3fw-663h

WordPress VibeBP plugin < 1.9.9.5.1 - SQL Injection vulnerability

LOW 37

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes VibeBP vibebp allows SQL Injection.This issue affects VibeBP: from n/a through < 1.9.9.5.1.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00485 Published 2024-12-31 No fix listed CWE-89

TI-2024-37075 CVE-2024-56039 · GHSA-r55v-gf2r-mcgv

WordPress VibeBP plugin < 1.9.9.7.7 - Unauthenticated SQL Injection vulnerability

MEDIUM 47

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes VibeBP vibebp allows SQL Injection.This issue affects VibeBP: from n/a through < 1.9.9.7.7.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.00606 Published 2024-12-31 No fix listed CWE-89

TI-2024-37082 CVE-2024-56046 · GHSA-4g88-vp7j-rp6x

WordPress WPLMS plugin <= 1.9.9 - Unauthenticated Arbitrary File Upload vulnerability

MEDIUM 50

Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through <= 1.9.9.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00753 Published 2024-12-31 No fix listed CWE-434

TI-2024-37083 CVE-2024-56047 · GHSA-jj38-rj6q-93vp

WordPress WPLMS plugin < 1.9.9.5.3 - Subscriber+ SQL Injection vulnerability

LOW 39

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows SQL Injection.This issue affects WPLMS: from n/a through < 1.9.9.5.3.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0062 Published 2024-12-18 No fix listed CWE-89

TI-2024-37089 CVE-2024-56053 · GHSA-q43h-jgq8-r4q8

WordPress WPLMS plugin < 1.9.9.5.3 - Instructor+ SQL Injection vulnerability

LOW 38

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows SQL Injection.This issue affects WPLMS: from n/a through < 1.9.9.5.3.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00437 Published 2024-12-18 No fix listed CWE-89

TI-2024-37084 CVE-2024-56048 · GHSA-2qgq-6952-hvw2

WordPress WPLMS plugin <= 1.9.9 - Arbitrary Option Update to Privilege Escalation vulnerability

MEDIUM 41

Missing Authorization vulnerability in VibeThemes WPLMS wplms_plugin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPLMS: from n/a through <= 1.9.9.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00602 Published 2024-12-18 No fix listed CWE-862

TI-2024-37086 CVE-2024-56050 · GHSA-hw6x-c383-cw53

WordPress WPLMS plugin < 1.9.9.5.3 - Subscriber+ Arbitrary File Upload vulnerability

MEDIUM 44

Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through < 1.9.9.5.3.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00691 Published 2024-12-18 No fix listed CWE-434

TI-2024-37088 CVE-2024-56052 · GHSA-f9jf-77vp-42qf

WordPress WPLMS plugin < 1.9.9.5.2 - Student+ Arbitrary File Upload vulnerability

MEDIUM 44

Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through < 1.9.9.5.2.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00691 Published 2024-12-18 No fix listed CWE-434

TI-2024-37090 CVE-2024-56054 · GHSA-g5gm-gv27-ppj9

WordPress WPLMS plugin < 1.9.9.5.2 - Instructor+ Arbitrary File Upload vulnerability

MEDIUM 42

Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through < 1.9.9.5.2.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00584 Published 2024-12-18 No fix listed CWE-434

TI-2024-37093 CVE-2024-56057 · GHSA-gxjw-49fg-j678

WordPress WPLMS plugin < 1.9.9.5.2 - Arbitrary File Upload vulnerability

MEDIUM 44

Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through < 1.9.9.5.2.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00557 Published 2024-12-18 No fix listed CWE-434

Vulnerabilities

Filters