Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 26

Export CSV
CVE-2025-49925

WordPress WPLMS plugin <= 1.9.9.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in VibeThemes WPLMS wplms_plugin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPLMS: from n/a through <= 1.9.9.7.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Vibethemes Wordpress
Products
Wordpress Learning Management System Wordpress
CVE-2025-32493

WordPress BP Social Connect plugin <= 1.6.2 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VibeThemes BP Social Connect bp-social-connect allows Stored XSS.This issue affects BP Social Connect: from n/a through <= 1.6.2.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Vibethemes Wordpress
Products
Bp Social Connect Wordpress
CVE-2024-56057

WordPress WPLMS plugin < 1.9.9.5.2 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through < 1.9.9.5.2.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Vibethemes Wordpress
Products
Wordpress Learning Management System Wordpress
CVE-2024-56054

WordPress WPLMS plugin < 1.9.9.5.2 - Instructor+ Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through < 1.9.9.5.2.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Vibethemes Wordpress
Products
Wordpress Learning Management System Wordpress
CVE-2024-56053

WordPress WPLMS plugin < 1.9.9.5.3 - Instructor+ SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows SQL Injection.This issue affects WPLMS: from n/a through < 1.9.9.5.3.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Vibethemes Wordpress
Products
Wordpress Learning Management System Wordpress
CVE-2024-56052

WordPress WPLMS plugin < 1.9.9.5.2 - Student+ Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through < 1.9.9.5.2.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Vibethemes Wordpress
Products
Wordpress Learning Management System Wordpress
CVE-2024-56051

WordPress WPLMS plugin < 1.9.9.5 - Student+ Remote Code Execution (RCE) vulnerability

Improper Control of Generation of Code ('Code Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows Code Injection.This issue affects WPLMS: from n/a through < 1.9.9.5.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Vibethemes Wordpress
Products
Wordpress Learning Management System Wordpress
CVE-2024-56050

WordPress WPLMS plugin < 1.9.9.5.3 - Subscriber+ Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through < 1.9.9.5.3.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Vibethemes Wordpress
Products
Wordpress Learning Management System Wordpress
CVE-2024-56048

WordPress WPLMS plugin <= 1.9.9 - Arbitrary Option Update to Privilege Escalation vulnerability

Missing Authorization vulnerability in VibeThemes WPLMS wplms_plugin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPLMS: from n/a through <= 1.9.9.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Vibethemes Wordpress
Products
Wordpress Learning Management System Wordpress
CVE-2024-56047

WordPress WPLMS plugin < 1.9.9.5.3 - Subscriber+ SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows SQL Injection.This issue affects WPLMS: from n/a through < 1.9.9.5.3.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Vibethemes Wordpress
Products
Wordpress Learning Management System Wordpress
CVE-2024-56046

WordPress WPLMS plugin <= 1.9.9 - Unauthenticated Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplms_plugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through <= 1.9.9.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Vibethemes Wordpress
Products
Wordpress Learning Management System Wordpress
CVE-2024-56044

WordPress WPLMS plugin <= 1.9.9 - Unauthenticated Arbitrary User Token Generation vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in VibeThemes WPLMS wplms_plugin allows Authentication Bypass.This issue affects WPLMS: from n/a through <= 1.9.9.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Vibethemes
Products
Wordpress Learning Management System
CVE-2024-56042

WordPress WPLMS plugin < 1.9.9.5.3 - Unauthenticated SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows SQL Injection.This issue affects WPLMS: from n/a through < 1.9.9.5.3.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Vibethemes Wordpress
Products
Wordpress Learning Management System Wordpress
CVE-2023-2704

BP Social Connect <= 1.5 - Authentication Bypass

The BP Social Connect plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.5. This is due to insufficient verification on the user being supplied during a Facebook login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.

CVSS 3.1 · 9.8 Critical EPSS 1.6% KEV · Not listed
Vendors
Vibethemes
Products
Bp Social Connect
CVE-2015-10139

WPLMS Learning Management System for WordPress, WordPress LMS <= 1.8.4.1 - Privilege Escalation

The WPLMS theme for WordPress is vulnerable to Privilege Escalation in versions 1.5.2 to 1.8.4.1 via the 'wp_ajax_import_data' AJAX action. This makes it possible for authenticated attackers to change otherwise restricted settings and potentially create a new accessible admin account.

CVSS 3.1 · 8.8 High EPSS 1.8% KEV · Not listed
Vendors
Vibethemes
Products
Wordpress Learning Management System