Skip to content
OpenAdvisories

Product · VibeThemes

WPLMS

24 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • High 8.5
    CVE-2026-95607

    WordPress WPLMS theme <= 4.973 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms allows Blind SQL Injection.This issue affects WPLMS : from n/a through 4.973.

    VibeThemes WPLMS
  • High 7.1
    CVE-2026-39722

    WordPress WPLMS theme <= 4.972 - Reflected Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in WPLMS <= 4.972 versions.

    VibeThemes WPLMS
  • High 8.6
    CVE-2025-69097

    WordPress WPLMS plugin <= 1.9.9.5.4 - Arbitrary File Deletion vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through <= 1.9.9.5.4.

    VibeThemes WPLMS
  • High 7.1
    CVE-2025-53420

    WordPress WPLMS plugin <= 1.9.9.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VibeThemes WPLMS wplms_plugin allows Reflected XSS.This issue affects WPLMS: from n/a through <= 1.9.9.8.

    VibeThemes WPLMS
  • High 7.5
    CVE-2025-49925

    WordPress WPLMS plugin <= 1.9.9.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in VibeThemes WPLMS wplms_plugin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPLMS: from n/a through <= 1.9.9.7.

    VibeThemes WPLMS
  • High 8.5
    CVE-2024-56047

    WordPress WPLMS plugin < 1.9.9.5.3 - Subscriber+ SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows SQL Injection.This issue affects WPLMS: from n/a through < 1.9.9.5.3.

    VibeThemes WPLMS
  • High 7.6
    CVE-2024-56053

    WordPress WPLMS plugin < 1.9.9.5.3 - Instructor+ SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows SQL Injection.This issue affects WPLMS: from n/a through < 1.9.9.5.3.

    VibeThemes WPLMS
  • High 8.8
    CVE-2024-56048

    WordPress WPLMS plugin <= 1.9.9 - Arbitrary Option Update to Privilege Escalation vulnerability

    Missing Authorization vulnerability in VibeThemes WPLMS wplms_plugin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPLMS: from n/a through <= 1.9.9.

    VibeThemes WPLMS
  • High 8.5
    CVE-2024-56049

    WordPress WPLMS plugin < 1.9.9.5.2 - Subscriber+ Arbitrary File Deletion vulnerability

    Path Traversal: '.../...//' vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through < 1.9.9.5.2.

    VibeThemes WPLMS
  • High 8.5
    CVE-2024-56055

    WordPress WPLMS plugin < 1.9.9.5.2 - Arbitrary Directory Deletion vulnerability

    Path Traversal: '.../...//' vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through < 1.9.9.5.2.

    VibeThemes WPLMS
  • High 8.5
    CVE-2024-56051

    WordPress WPLMS plugin < 1.9.9.5 - Student+ Remote Code Execution (RCE) vulnerability

    Improper Control of Generation of Code ('Code Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows Code Injection.This issue affects WPLMS: from n/a through < 1.9.9.5.

    VibeThemes WPLMS
  • High 8.1
    CVE-2023-36690

    WordPress WPLMS Theme < 4.900 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in VibeThemes WPLMS theme <= 4.900 versions.

    VibeThemes WPLMS