Skip to content
OpenAdvisories

Vendor

VibeThemes

32 known vulnerabilities.

Products

WPLMS 24 VibeBP 4 WPLMS Learning Management System for WordPress, WordPress LMS 2 BP Social Connect 2
All Critical High Medium Low Exploited only Public exploit

15 results · Clear filters · Feed

  • High 8.8
    CVE-2026-16135

    VibeBP <= 1.9.9.8.1 - Authenticated (Subscriber+) Privilege Escalation in set_email_notification_settings()

    The VibeBP plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.9.9.8.1. This is due to the plugin allowing arbitrary user meta updates through the set_email_notification_settings() function. This makes it possibl…

    VibeThemes VibeBP Web / CMS
  • High 8.5
    CVE-2026-95607

    WordPress WPLMS theme <= 4.973 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms allows Blind SQL Injection.This issue affects WPLMS : from n/a through 4.973.

    VibeThemes WPLMS
  • High 7.1
    CVE-2026-39722

    WordPress WPLMS theme <= 4.972 - Reflected Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in WPLMS <= 4.972 versions.

    VibeThemes WPLMS
  • High 8.6
    CVE-2025-69097

    WordPress WPLMS plugin <= 1.9.9.5.4 - Arbitrary File Deletion vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through <= 1.9.9.5.4.

    VibeThemes WPLMS
  • High 7.1
    CVE-2025-53420

    WordPress WPLMS plugin <= 1.9.9.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VibeThemes WPLMS wplms_plugin allows Reflected XSS.This issue affects WPLMS: from n/a through <= 1.9.9.8.

    VibeThemes WPLMS
  • High 7.5
    CVE-2025-49925

    WordPress WPLMS plugin <= 1.9.9.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in VibeThemes WPLMS wplms_plugin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPLMS: from n/a through <= 1.9.9.7.

    VibeThemes WPLMS
  • High 8.8
    CVE-2015-10139 Public exploit

    WPLMS Learning Management System for WordPress, WordPress LMS <= 1.8.4.1 - Privilege Escalation

    The WPLMS theme for WordPress is vulnerable to Privilege Escalation in versions 1.5.2 to 1.8.4.1 via the 'wp_ajax_import_data' AJAX action. This makes it possible for authenticated attackers to change otherwise restricted settings and potentially create a new…

    VibeThemes WPLMS Learning Management System for WordPress, WordPress LMS Web / CMS
  • High 8.5
    CVE-2024-56041

    WordPress VibeBP plugin < 1.9.9.5.1 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes VibeBP vibebp allows SQL Injection.This issue affects VibeBP: from n/a through < 1.9.9.5.1.

    VibeThemes VibeBP
  • High 8.5
    CVE-2024-56047

    WordPress WPLMS plugin < 1.9.9.5.3 - Subscriber+ SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows SQL Injection.This issue affects WPLMS: from n/a through < 1.9.9.5.3.

    VibeThemes WPLMS
  • High 7.6
    CVE-2024-56053

    WordPress WPLMS plugin < 1.9.9.5.3 - Instructor+ SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows SQL Injection.This issue affects WPLMS: from n/a through < 1.9.9.5.3.

    VibeThemes WPLMS
  • High 8.8
    CVE-2024-56048

    WordPress WPLMS plugin <= 1.9.9 - Arbitrary Option Update to Privilege Escalation vulnerability

    Missing Authorization vulnerability in VibeThemes WPLMS wplms_plugin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPLMS: from n/a through <= 1.9.9.

    VibeThemes WPLMS
  • High 8.5
    CVE-2024-56049

    WordPress WPLMS plugin < 1.9.9.5.2 - Subscriber+ Arbitrary File Deletion vulnerability

    Path Traversal: '.../...//' vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through < 1.9.9.5.2.

    VibeThemes WPLMS
  • High 8.5
    CVE-2024-56055

    WordPress WPLMS plugin < 1.9.9.5.2 - Arbitrary Directory Deletion vulnerability

    Path Traversal: '.../...//' vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through < 1.9.9.5.2.

    VibeThemes WPLMS
  • High 8.5
    CVE-2024-56051

    WordPress WPLMS plugin < 1.9.9.5 - Student+ Remote Code Execution (RCE) vulnerability

    Improper Control of Generation of Code ('Code Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows Code Injection.This issue affects WPLMS: from n/a through < 1.9.9.5.

    VibeThemes WPLMS
  • High 8.1
    CVE-2023-36690

    WordPress WPLMS Theme < 4.900 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in VibeThemes WPLMS theme <= 4.900 versions.

    VibeThemes WPLMS