Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
30 results
Oct 21, 2026Uncanny Toolkit for LearnDash: Does not verify that the acting user is permitted to manage the targeted accounts before changing their verification stateCVE-2026-107128 · WordPress plugins & themes · reported by WPScanMedium 5
The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not verify that the acting user is permitted to manage the targeted accounts before changing their verification state, allowing a subsite administrator on a multisite network to mark arbitrary network users outside their own site as unverified and prevent those users from logging in.
- Product
- Uncanny Toolkit for LearnDash
- Fixed in
- 3.8.2
- What to do
- Update Uncanny Toolkit for LearnDash to 3.8.2 or newer.
Oct 21, 2026Uncanny Toolkit for LearnDash: Does not validate the origin of a password-reset requestCVE-2026-107127 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validate the origin of a password-reset request, allowing an unauthenticated attacker to set the password of a user who is partway through a password reset to an attacker-chosen value through a forged request, resulting in full account takeover.
- Product
- Uncanny Toolkit for LearnDash
- Fixed in
- 3.8.2
- What to do
- Update Uncanny Toolkit for LearnDash to 3.8.2 or newer.
Sep 5, 2026LearnDash LMS: Authorization bypassCVE-2026-12843 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in versions 4.25.0 - 5.1.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to enroll arbitrary users in paid courses without payment verification, bypassing the entire payment system and gaining unauthorized access to premium educational content.
- Product
- LearnDash LMS
- Affected
- 4.25.0 to 5.1.6
- What to do
- Affects 4.25.0 to 5.1.6. Update LearnDash LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddocs.nexcess.comwordfence.com
Sep 4, 2026LearnDash LMS: Unrestricted File Type UploadCVE-2026-12483 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The LearnDash LMS plugin for WordPress is vulnerable to Unrestricted File Type Upload in versions up to and including 5.1.5. This is due to insufficient input validation in the 'learndash_fileupload_process' function, which iterates through an entire array and validates only the first file. This makes it possible for authenticated attackers, with subscriber-level access and above who are enrolled in a course with assignment uploads enabled, to upload arbitrary disallowed files, including PHP files, to the server's wp-content/uploads/learndash/assignments/ directory. The uploaded files can only be used for Remote Code Execution if default server configurations have been changed to allow for execution.
- Product
- LearnDash LMS
- Affected
- up to 5.1.5
- What to do
- Affects up to 5.1.5. Update LearnDash LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordliquidweb.comwordfence.com
Mar 23, 2026LearnDash LMS: Blind time-based SQL InjectionCVE-2026-3079 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The LearnDash LMS plugin for WordPress is vulnerable to blind time-based SQL Injection via the 'filters[orderby_order]' parameter in the 'learndash_propanel_template' AJAX action in all versions up to, and including, 5.0.3. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- LearnDash LMS
- Affected
- up to 5.0.3
- What to do
- Affects up to 5.0.3. Update LearnDash LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordlearndash.complugins.trac.wordpress.org
Mar 6, 2026PowerPack for LearnDash: Does not have authorization and CRSF checks in an AJAX actionCVE-2026-2446 · WordPress plugins & themes · reported by WPScanCritical 9.8
The PowerPack for LearnDash WordPress plugin before 1.3.0 does not have authorization and CRSF checks in an AJAX action, allowing unauthenticated users to update arbitrary WordPress options (such as default_role etc) and create arbitrary admin users
- Product
- PowerPack for LearnDash
- Fixed in
- 1.3.0
- What to do
- Update PowerPack for LearnDash to 1.3.0 or newer.
Oct 11, 2025Course Redirects for Learndash: Cross-Site Request ForgeryCVE-2025-10376 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Course Redirects for Learndash plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.4. This is due to missing nonce validation when processing form submissions on the settings page. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Product
- Course Redirects for Learndash
- Affected
- up to 0.4
- What to do
- Affects up to 0.4. Update Course Redirects for Learndash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Sep 22, 2025Uncanny Toolkit for LearnDash: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-57988 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash uncanny-learndash-toolkit allows Stored XSS.This issue affects Uncanny Toolkit for LearnDash: from n/a through <= 3.7.0.3.
- Product
- Uncanny Toolkit for LearnDash
- Affected
- up to 3.7.0.3
- What to do
- Affects up to 3.7.0.3. Update Uncanny Toolkit for LearnDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 16, 2025Uncanny Toolkit for LearnDash: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-48080 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash uncanny-learndash-toolkit allows Stored XSS.This issue affects Uncanny Toolkit for LearnDash: from n/a through <= 3.7.0.2.
- Product
- Uncanny Toolkit for LearnDash
- Affected
- up to 3.7.0.2
- What to do
- Affects up to 3.7.0.2. Update Uncanny Toolkit for LearnDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 15, 2025Uncanny Toolkit for LearnDash: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-22268 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash uncanny-learndash-toolkit allows Stored XSS.This issue affects Uncanny Toolkit for LearnDash: from n/a through <= 3.7.0.1.
- Product
- Uncanny Toolkit for LearnDash
- Affected
- up to 3.7.0.1
- What to do
- Affects up to 3.7.0.1. Update Uncanny Toolkit for LearnDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 27, 2025LearnDash LMS: Missing AuthorizationCVE-2025-24662 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in LearnDash LearnDash LMS allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnDash LMS: from n/a through 4.20.0.1.
- Product
- LearnDash LMS
- Affected
- up to 4.20.0.1
- What to do
- Affects up to 4.20.0.1. Update LearnDash LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 15, 2025Course Migration for LearnDash: Server-Side Request Forgery (SSRF)CVE-2025-22346 · WordPress plugins & themes · reported by PatchstackMedium 6.4
Server-Side Request Forgery (SSRF) vulnerability in Faizaan Gagan Course Migration for LearnDash allows Server Side Request Forgery.This issue affects Course Migration for LearnDash: from 1.0.2 through n/a.
- Product
- Course Migration for LearnDash
- What to do
- Update Course Migration for LearnDash to the newest version.
Jan 2, 2025Uncanny Toolkit Pro for LearnDash: Cross-Site Request Forgery (CSRF)CVE-2024-37438 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Uncanny Owl Uncanny Toolkit Pro for LearnDash allows Cross Site Request Forgery.This issue affects Uncanny Toolkit Pro for LearnDash: from n/a before 4.1.4.1.
- Product
- Uncanny Toolkit Pro for LearnDash
- Fixed in
- 4.1.4.1
- What to do
- Update Uncanny Toolkit Pro for LearnDash to 4.1.4.1 or newer.
Dec 13, 2024Uncanny Toolkit for LearnDash: Missing AuthorizationCVE-2023-34019 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uncanny Toolkit for LearnDash: from n/a through 3.6.4.3.
- Product
- Uncanny Toolkit for LearnDash
- Affected
- up to 3.6.4.3
- What to do
- Affects up to 3.6.4.3. Update Uncanny Toolkit for LearnDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2024Uncanny Toolkit Pro for LearnDash: Missing AuthorizationCVE-2024-37439 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Uncanny Owl Uncanny Toolkit Pro for LearnDash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uncanny Toolkit Pro for LearnDash: from n/a through 4.1.4.0
- Product
- Uncanny Toolkit Pro for LearnDash
- What to do
- Update Uncanny Toolkit Pro for LearnDash to the newest version.
Sep 24, 2024Uncanny Groups for LearnDash: User group addCVE-2024-8350 · WordPress plugins & themes · reported by WordfenceLow 2.7
The Uncanny Groups for LearnDash plugin for WordPress is vulnerable to user group add due to a missing capability check on the /wp-json/ulgm_management/v1/add_user/ REST API endpoint in all versions up to, and including, 6.1.0.1. This makes it possible for authenticated attackers, with group leader-level access and above, to add users to their group which ultimately allows them to leverage CVE-2024-8349 and gain admin access to the site.
- Product
- Uncanny Groups for LearnDash
- Affected
- up to 6.1.0.1
- What to do
- Affects up to 6.1.0.1. Update Uncanny Groups for LearnDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.comwordfence.com
Sep 24, 2024Uncanny Groups for LearnDash: Privilege escalationCVE-2024-8349 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Uncanny Groups for LearnDash plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 6.1.0.1. This is due to the plugin not properly restricting what users a group leader can edit. This makes it possible for authenticated attackers, with group leader-level access and above, to change admin account email addresses which can subsequently lead to admin account access.
- Product
- Uncanny Groups for LearnDash
- Affected
- up to 6.1.0.1
- What to do
- Affects up to 6.1.0.1. Update Uncanny Groups for LearnDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.comwordfence.com
Aug 1, 2024Tin Canny Reporting for LearnDash: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-39656 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Uncanny Owl Tin Canny Reporting for LearnDash allows Reflected XSS.This issue affects Tin Canny Reporting for LearnDash: from n/a through 4.3.0.7.
- Product
- Tin Canny Reporting for LearnDash
- Affected
- up to 4.3.0.7
- What to do
- Affects up to 4.3.0.7. Update Tin Canny Reporting for LearnDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 22, 2024Uncanny Toolkit Pro for LearnDash: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37436 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Uncanny Owl Uncanny Toolkit Pro for LearnDash allows Reflected XSS.This issue affects Uncanny Toolkit Pro for LearnDash: from n/a before 4.1.4.1.
- Product
- Uncanny Toolkit Pro for LearnDash
- Fixed in
- 4.1.4.1
- What to do
- Update Uncanny Toolkit Pro for LearnDash to 4.1.4.1 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 9, 2024LearnDash LMS – Reports: Unauthorized modification of dataCVE-2024-5648 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The LearnDash LMS – Reports plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions (i.e. wrld_set_configuration, wrld_exclude_settings_save, apply_time_tracking_settings, wp_ajax_wrld_gutenberg_block_visit, etc..) in all versions up to, and including, 1.8.2.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to update various plugin settings.
- Product
- LearnDash LMS – Reports
- Affected
- up to 1.8.2.1
- What to do
- Affects up to 1.8.2.1. Update LearnDash LMS – Reports to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 27, 2024Uncanny Toolkit for LearnDash: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-34020 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash.This issue affects Uncanny Toolkit for LearnDash: from n/a through 3.6.4.3.
- Product
- Uncanny Toolkit for LearnDash
- Affected
- up to 3.6.4.3
- What to do
- Affects up to 3.6.4.3. Update Uncanny Toolkit for LearnDash to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Feb 5, 2024LearnDash LMS: Sensitive Information ExposureCVE-2024-1210 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.1 via API. This makes it possible for unauthenticated attackers to obtain access to quizzes.
- Product
- LearnDash LMS
- Affected
- up to 4.10.1
- What to do
- Affects up to 4.10.1. Update LearnDash LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.comlearndash.com
Feb 5, 2024LearnDash LMS: Sensitive Information ExposureCVE-2024-1209 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.1 via direct file access due to insufficient protection of uploaded assignments. This makes it possible for unauthenticated attackers to obtain those uploads.
- Product
- LearnDash LMS
- Affected
- up to 4.10.1
- What to do
- Affects up to 4.10.1. Update LearnDash LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.comlearndash.com
Feb 5, 2024LearnDash LMS: Sensitive Information ExposureCVE-2024-1208 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.2 via API. This makes it possible for unauthenticated attackers to obtain access to quiz questions.
- Product
- LearnDash LMS
- Affected
- up to 4.10.2
- What to do
- Affects up to 4.10.2. Update LearnDash LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.comlearndash.com
Oct 31, 2023LearnDash LMS: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-28777 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LearnDash LearnDash LMS allows SQL Injection.This issue affects LearnDash LMS: from n/a through 4.5.3.
- Product
- LearnDash LMS
- Affected
- up to 4.5.3
- What to do
- Affects up to 4.5.3. Update LearnDash LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 12, 2023LearnDash LMS: Insecure Direct Object ReferencesCVE-2023-3105 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The LearnDash LMS plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 4.6.0. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for attackers with with existing account access at any level, to change user passwords and potentially take over administrator accounts.
- Product
- LearnDash LMS
- Affected
- up to 4.6.0
- What to do
- Affects up to 4.6.0. Update LearnDash LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordlearndash.comwordfence.com
May 26, 2023Cross-Site Request Forgery (CSRF) vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash plugin <= 3.6.4.1 versions.CVE-2023-23714 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash plugin <= 3.6.4.1 versions.
- Affected
- up to 3.6.4.1
- What to do
- Affects up to 3.6.4.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Nov 1, 2021LearnDash LMS: Does not have any authorisation and validation of the file to be uploaded in the learndash_assignment_process_init() functionCVE-2018-25019 · WordPress plugins & themes · reported by WPScanHigh 7.5
The LearnDash LMS WordPress plugin before 2.5.4 does not have any authorisation and validation of the file to be uploaded in the learndash_assignment_process_init() function, which could allow unauthenticated users to upload arbitrary files to the web server
- Product
- LearnDash LMS
- Fixed in
- 2.5.4
- What to do
- Update LearnDash LMS to 2.5.4 or newer.
Full record and what to do →NVD recordlists.openwall.netwpscan.com
Apr 1, 2020LearnDash Wordpress plugin version below 3.1.6 is vulnerable to Unauthenticated SQL Injection.CVE-2020-6009 · WordPress plugins & themes · reported by cve@checkpoint.comCritical 9.8
LearnDash Wordpress plugin version below 3.1.6 is vulnerable to Unauthenticated SQL Injection.
- Fixed in
- 3.1.6
- What to do
- Update the plugin to 3.1.6 or newer.
Full record and what to do →NVD recordlearndash.releasenotes.iolearndash.releasenotes.io
Jan 16, 2020The LearnDash LMS plugin before 3.1.2 for WordPress allows XSS via the ld-profile search field.CVE-2020-7108 · WordPress plugins & themes · reported by MITREMedium 5.4
The LearnDash LMS plugin before 3.1.2 for WordPress allows XSS via the ld-profile search field.
- Product
- LearnDash LMS
- Fixed in
- 3.1.2
- What to do
- Update LearnDash LMS to 3.1.2 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comlearndash.releasenotes.io
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.