WP Learn Manager <= 1.1.8 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation and Activation via jslearnmanager_ajax AJAX Action
critical
The WP Learn Manager plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.8. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins fro...
- CVSS:
- 9.8
- Affected:
- up to 1.1.8
- Fix:
- No patched version reported
- Disclosed:
- Jul 7, 2026
CVE-2026-12153 on NVD →
WP LMS – Best WordPress LMS Plugin <= 1.1.4 - Cross-Site Request Forgery
high
The WP LMS – Best WordPress LMS Plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.4. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to create and edit user-related data via a forged requ...
- CVSS:
- 8.8
- Affected:
- up to 1.1.4
- Fixed in:
- 1.1.5
- Disclosed:
- Aug 2, 2021
WP LMS – Best WordPress LMS Plugin <= 1.1.5 - Cross-Site Scripting
medium
The WP LMS – Best WordPress LMS Plugin WordPress plugin through 1.1.5 does not properly sanitise or validate its User Field Titles, allowing XSS payload to be used in them. Furthermore, no CSRF and capability checks were in place, allowing such attack to be performed either via CSRF or as any user (including unauthenti...
- CVSS:
- 6.1
- Affected:
- up to 1.1.5
- Fixed in:
- 1.1.6
- Disclosed:
- May 24, 2021
CVE-2021-24504 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database