Wp Courses Vulnerabilities

The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.2.29 via the 'resultID' parameter due to missing validation on a user controlled key. This makes it possible...

CVSS:

4.3

Affected:

up to 3.2.29

Fixed in:

3.2.30

Disclosed:

Aug 24, 2026

CVE-2026-10630 on NVD →

The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.2.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, w...

CVSS:

6.4

Affected:

up to 3.2.26

Fixed in:

3.2.27

Disclosed:

Mar 23, 2026

CVE-2026-31914 on NVD →

[en] The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpc_update_user_meta_option() function in all versions up to, and including, 3.2.21. This makes it possible for auth...

Affected:

up to 3.2.22

Fixed in:

3.2.22

Disclosed:

Dec 12, 2024

CVE-2024-12172 on NVD →

The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wpc_update_user_meta_option() function in all versions up to, and including, 3.2.21. This makes it possible for authentic...

CVSS:

7.5

Affected:

up to 3.2.21

Fixed in:

3.2.22

Disclosed:

Dec 11, 2024

CVE-2024-12172 on NVD →

Update the WordPress WP Courses LMS plugin to the latest available version (at least 3.2.4). Unknown discovered and reported this Broken Access Control vulnerability in WordPress WP Courses LMS Plugin. A broken access control issue refers to a missing authorization, authentication or nonce token check in a function tha...

Affected:

up to 3.2.4

Fixed in:

3.2.4

Disclosed:

Nov 15, 2023

Update the WordPress WP Courses LMS plugin to the latest available version (at least 3.2.4). Unknown discovered and reported this Broken Access Control vulnerability in WordPress WP Courses LMS Plugin. A broken access control issue refers to a missing authorization, authentication or nonce token check in a function tha...

Affected:

up to 3.2.4

Fixed in:

3.2.4

Disclosed:

Nov 15, 2023

Update the WordPress WP Courses LMS plugin to the latest available version (at least 3.2.4). Unknown discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress WP Courses LMS Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under thei...

Affected:

up to 3.2.4

Fixed in:

3.2.4

Disclosed:

Nov 15, 2023

The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability check on the wpc_save_fe_option() function hooked via AJAX in all versions up to, and including, 3.2.3. This makes it poss...

CVSS:

8.8

Affected:

up to 3.2.3

Fixed in:

3.2.4

Disclosed:

Nov 14, 2023

The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.3. This is due to missing nonce validation on several functions hooked via AJAX in the ~/ajax/ajax-lesson-order.p...

CVSS:

4.3

Affected:

up to 3.2.3

Fixed in:

3.2.4

Disclosed:

Nov 14, 2023

The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on several functions in the ~/ajax/ajax-lesson-order.php file hooked via AJAX in all versions up to, and including,...

CVSS:

4.3

Affected:

up to 3.2.3

Fixed in:

3.2.4

Disclosed:

Nov 14, 2023

The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on several functions in the ~/ajax/ajax-lesson-order.php file hooked via AJAX in all versions up to, and including,...

Affected:

up to 3.2.4

Fixed in:

3.2.4

Disclosed:

Nov 14, 2023

The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability check on the wpc_save_fe_option() function hooked via AJAX in all versions up to, and including, 3.2.3. This makes it poss...

Affected:

up to 3.2.4

Fixed in:

3.2.4

Disclosed:

Nov 14, 2023

The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.3. This is due to missing nonce validation on several functions hooked via AJAX in the ~/ajax/ajax-lesson-order.p...

Affected:

up to 3.2.4

Fixed in:

3.2.4

Disclosed:

Nov 14, 2023

[en] The WP Courses LMS WordPress plugin before 2.0.44 does not sanitise its Video Embed Code, allowing malicious code to be injected in it by high privilege users, even when the unfiltered_html capability is disallowed, which could lead to Stored Cross-Site Scripting issues

Affected:

up to 2.0.44

Fixed in:

2.0.44

Disclosed:

Sep 13, 2021

CVE-2021-24621 on NVD →

The WP Courses LMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions before 2.0.44 due to improper handling of the unfiltered_html capability. This makes it possible for administrator-level attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an inje...

CVSS:

4.8

Affected:

up to 2.0.44

Fixed in:

2.0.44

Disclosed:

Aug 16, 2021

CVE-2021-24621 on NVD →

[en] The wp-courses plugin through 2.0.27 for WordPress allows remote attackers to bypass the intended payment step (for course videos and materials) by using the /wp-json REST API, as exploited in the wild in September 2020. This occurs because show_in_rest is enabled for custom post types (e.g., /wp-json/wp/v2/course...

Affected:

up to 2.0.29

Fixed in:

2.0.29

Disclosed:

Oct 7, 2020

CVE-2020-26876 on NVD →

The wp-courses plugin through 2.0.27 for WordPress allows remote attackers to bypass the intended payment step (for course videos and materials) by using the /wp-json REST API, as exploited in the wild in September 2020. This occurs because show_in_rest is enabled for custom post types (e.g., /wp-json/wp/v2/course and...

CVSS:

7.5

Affected:

up to 2.0.28

Fixed in:

2.0.29

Disclosed:

Sep 28, 2020

CVE-2020-26876 on NVD →

The plugin does not escape some parameters before outputting them back in admin pages, leading to Reflected Cross-Site Scripting issues

Affected:

up to 2.0.44

Fixed in:

2.0.44

The plugin is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.3. This is due to missing nonce validation on several functions hooked via AJAX in the ~/ajax/ajax-lesson-order.php file. This makes it possible for unauthenticated attackers to to perform several actions such as adding, de...

Affected:

up to 3.2.4

Fixed in:

3.2.4

The plugin is vulnerable to unauthorized modification of data due to missing capability check on the wpc_save_fe_option() function hooked via AJAX in all versions up to, and including, 3.2.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options which ca...

Affected:

up to 3.2.4

Fixed in:

3.2.4

The plugin is vulnerable to unauthorized modification of data due to missing capability checks on several functions in the ~/ajax/ajax-lesson-order.php file hooked via AJAX in all versions up to, and including, 3.2.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform...

Affected:

up to 3.2.4

Fixed in:

3.2.4