Learndash

12 CVEs across 2 Learndash products. Browse Learndash vulnerabilities, severities, and proof-of-concept exploits.

Learndash products with known CVEs

ProductCVEs
Learndash11
Learndash Lms2
Learndash CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2024-56940High7.52025-02-12An issue in the profile image upload function of LearnDash v6.7.1 allows attackers to cause a Denial of Service (DoS) via excessive file uploads.
CVE-2024-56939Medium5.42025-02-12LearnDash v6.7.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the ld-comment-body class.
CVE-2024-56938Medium5.42025-02-12LearnDash v6.7.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the materials-content class.
CVE-2025-24662Medium5.32025-01-27Missing Authorization vulnerability in LearnDash LearnDash LMS allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Learn…
CVE-2024-1210Medium5.32024-02-05The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.1 via API. This makes it poss…
CVE-2024-1209Medium5.32024-02-05The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.1 via direct file access due…
CVE-2024-1208Medium5.32024-02-05The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.2 via API. This makes it poss…
CVE-2023-28777High8.52023-10-31Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LearnDash LearnDash LMS allows SQL Injection.This issue a…
CVE-2023-3105High8.82023-07-12The LearnDash LMS plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 4.6.0. This is due to the plugin pr…
CVE-2018-25019High7.52021-11-01The LearnDash LMS WordPress plugin before 2.5.4 does not have any authorisation and validation of the file to be uploaded in the learndash_assignment_process_i…
CVE-2020-6009Critical9.82020-04-01LearnDash Wordpress plugin version below 3.1.6 is vulnerable to Unauthenticated SQL Injection.
CVE-2020-7108Medium5.42020-01-16The LearnDash LMS plugin before 3.1.2 for WordPress allows XSS via the ld-profile search field.