Plugin Pulse Beta
← Pulse

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses

by ThimPress · Education

Also makes 20 other plugins · 174K+ installs across the portfolio →

Try it live ↗ wp.org ↗

A WordPress LMS Plugin to create WordPress Learning Management System. Turn your WordPress to LMS WordPress Website with Courses, Lessons, Quizzes &am …

Try it live opens a temporary test site in your browser, which can take about 20 seconds to load. Plugins that rely on outside services or a full server may not work completely there.

⚠ Open vulnerability

Health

B 78/100

Open vulnerability

Active installs

70K+

≈75K estimated

Momentum

+22%

downloads vs prior 30d

Biggest opportunity: Support resolution scores 80/100. Mark more forum threads resolved — the resolved ratio feeds the ranking.

See the detail → Get the free audit
How scoring works →
78 Health · B
Maintenance 100/100
Rating quality 84/100
Support 86/100
Security 5/100

78 health vs 69 average across 280 Education plugins

70K+

Active installs

≈75K estimated

6.6M

Total downloads

since 2015 · 1.1% still active

4.3/5

Rating

597 reviews · +0.2/wk

+22%

114K

Downloads · 30d

category median +21%

Install conversion

How it's measured →

1.1%

of downloads still active

At least 70K of 6.6M lifetime downloads are still running, in line with its category: the median Education plugin keeps 1.0%, across 176 plugins.

Downloads count every update, not just first installs, so older and more frequently released plugins read lower. Compare against other Education plugins, not across the directory. wp.org reports active installs as the bottom of a band, so the real rate is this or higher.

This plugin shipped 34 releases in the last 12 months, and every existing install that updated counted as another download. wp.org publishes no split between first installs and updates, so we show the raw rate rather than guess at one.

Ratings · 597 reviews

Read on wp.org ↗
5★
476 4★
19 3★
11 2★
12 1★
79

Details

Version
4.4.13
Last updated
yesterday
Added
2015-06-07 · 11 yrs old
Requires WP
6.0
Tested up to
7.1.4
Requires PHP
7.4
Changelog ↗Support forum ↗Reviews ↗Advanced stats ↗

Directory ranking optimization

How it's scored →

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

94 / 100

Excellent listing optimization

Well tuned across the board

Update recency 100/100

Updated 1 day ago

WP compatibility 100/100

Tested up to WordPress 7.1.4, the current branch or newer

Rating quality 86/100

4.3★ over 597 reviews, smoothed to 4.28★

Listing tuning 100/100

5 of 5 tags set · short description in place

Support resolution 80/100

4 of 5 support threads resolved in the last 2 months

Daily downloads

Since 5 Oct 2022 · 1,488 days · wp.org + Plugin Pulse archive

+22% vs prior 30d
1.5K31 Oct 2026

30-day downloads

Rolling 30-day volume · peak 147.4K · peaks are release surges

121K31 Oct 2026

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

LearnPress · #611youTutor LMS · #462MasterStudy LMS Word · #1776StepUp LMS · #64775

Rating trend

Star average over time · dips mark rough releases

4.331 Oct 2026

Health trend

Composite health score, snapshotted daily

7831 Oct 2026

Update activity

How busy the existing users are, measured as downloads in the last 30 days for every 1,000 active sites. A spike means a new release everyone's pulling; a long, slow decline means an aging user base that updates less.

1.7K31 Oct 2026

Release cadence

Actively maintained
from wp.org release tags

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

34

releases in the last 12 months

yesterday

latest release · v4.4.13 · 30 Oct 2026

144

tagged releases on record

Recent releases

4.4.13 · 30 Oct 20264.4.12 · 23 Oct 20264.4.11 · 16 Oct 20264.4.10 · 9 Oct 20264.4.9.1 · 1 Oct 20264.4.9 · 28 Sep 20264.4.8 · 18 Sep 20264.4.7 · 11 Sep 20264.4.6 · 4 Sep 20264.4.5 · 22 Aug 20264.4.4 · 13 Aug 20264.4.3 · 26 Jul 20264.4.2 · 11 Jul 20264.4.1 · 26 Jun 2026

What its installed base runs

via wordpress.org

Share of active installs on each version of this plugin · 38% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

v4.4 38%
v4.2 29%
v4.3 22%
v3.2 5.2%
v4.1 5.1%
Older / other versions 1.4%

Estimated active installs

The public count shows “70K+”. Our estimate pins where the real number sits.

tracked estimate
70K–80K ≈75K

Crossed into this band 6 months ago; a band this size takes about a year or more to cross, which places it about 54% of the way through.

Install history since 1 Oct 2021

70K31 Oct 2026

Recent reviews

All reviews on wp.org ↗
  1. ★★★★★ shaleneza
    4mo ago

    I have been using LearnPress for years. I have noticed that support has very much improved. If you tried LP before and struggled, give it another chance. The plugin is really very good now and the support is excellent.

    Read on wp.org ↗
  2. ★★★★★ sonicsha
    5mo ago

    I totally recommend them. They smoothly helped me out in every way they can whenever I needed them.

    Read on wp.org ↗
  3. ★★★★★ José Manuel
    7mo ago

    Como es posible, que con la version 4.3.5, se rompa toda la base de datos? No distinque a los usuarios, se pierde la wishh-list, no salen los cursos en la portada…. un desastre. Como siga la cosa así, me busco otra LMS. This topic was modified 3 months ago by José Manuel.

    Read on wp.org ↗
  4. ★★★★★ linternet6
    8mo ago

    Really nice, a joy to use.

    Read on wp.org ↗
  5. ★★★★★ Dunos
    9mo ago

    I’ve been using LearnPress for a while now and it does exactly what I need for building online courses. It’s easy to use, and the new AI feature is a great bonus. I really appreciate that the team keeps improving the plugin, and I’m excited to see what new features come in future updates. Definitely a 5-star plugin!

    Read on wp.org ↗
  6. ★★★★★ Alex
    9mo ago

    Easy and flexible plugin

    Read on wp.org ↗
  7. ★★★★★ bakhtiyor1chi
    11mo ago

    I recommend it for anyone who is planning to sell online courses or build platform for it. You can do it in your own language as well. The PlugIn has good interface, good speed and a wide range of features. They also offer paid theme but you get a long with free ones for the beginning. This topic was modified 7 months, 4 weeks ago by bakhtiyor1chi.

    Read on wp.org ↗
  8. ★★★★★ robertodimaio
    1.0y ago

    The technical support hasn’t been the best so far, but it seems they’re improving, and considering the latest updates, I can express my full satisfaction. I hope this satisfaction continues over time. Good luck and thank to Brianvu-tp

    Read on wp.org ↗

Latest updates

via wp.org changelog

Recent releases and news for this plugin

  1. 2026-10-23 Version 4.4.12 Fixed: security (Props @Patchstack, @harry nguyen, @MinKhoy, @ssophiz). Fixed: incorrect list courses on Categories, Tags Backend Fixed: error permission call API list courses for App. 4.4.12
  2. 2026-10-16 Version 4.4.11 Fixed: security (Props @Wordfence, @Patchstack, @Ananda Dhakal, @daroo, @MD Mahmidul Hasan). Fixed: minor bugs. Added: feature private student notes for lessons and courses on learning screen, manager on LP profile, WP b 4.4.11
  3. 2026-10-09 Version 4.4.10 Fixed: security (Props @Wordfence, @Kuba, @Wordfence PRISM, @Hunter Sploit, @Artur Chlebicki). Style: themes, addons manager, Course Builder. Fixed: minor bugs. 4.4.10
  4. 2026-10-01 Version 4.4.9.1 Fixed: role instructor can’t access WP Admin when install new. Fixed: active purchase code. Fixed: icons students, courses. 4.4.9.1
  5. 2026-09-27 Version 4.4.9 Refactor: Add-ons manager and lp admin notices. Fixed: security (Props @Khoa Dang, @Wordfence, @Hyebin Noh) Fixed: minor bugs. Fixed: custom post type screen check and quick edit missing fields. Fixed: error 404 course e 4.4.9
  6. 2026-09-18 Version 4.4.8 Fixed: security (Props @Yuto Hyakumoto, @Wordfence). Refactor: tables custom post type, lesson, order, question, quiz. Refactor: query list courses, lessons, questions, quizzes on WP Backend list posts. Fixed: PayPal tok 4.4.8

Security history

via Wordfence Intelligence

2 open vulnerabilities affect the current version (4.4.13). 99 of 101 disclosed are patched.

  1. Patched Medium · 5.3 LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.11 - Missing Authorization ↗
    2026-10-26 CVE-2026-115598 Missing Authorization Affects <= 4.4.11 Patched in 4.4.12
  2. Patched Medium · 4.3 LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.11 - Missing Authorization ↗
    2026-10-26 CVE-2026-115597 Missing Authorization Affects <= 4.4.11 Patched in 4.4.12
  3. Open Medium · 4.3 LearnPress – WordPress LMS Plugin for Create and Sell Online Courses < 4.4.10 - Authenticated (Custom+) Insecure Direct Object Reference ↗
    2026-10-20 CVE-2026-113353 Authorization Bypass Through User-Controlled Key Affects < 4.4.10 No patch available
  4. Patched Medium · 4.3 LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.10 - Missing Authorization ↗
    2026-10-20 CVE-2026-42690 Missing Authorization Affects <= 4.4.10 Patched in 4.4.11
  5. Patched Medium · 4.3 LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.10 - Missing Authorization ↗
    2026-10-19 CVE-2026-110363 Missing Authorization Affects <= 4.4.10 Patched in 4.4.11
  6. Patched Critical · 9.8 LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter ↗
    2026-10-16 CVE-2026-104736 Deserialization of Untrusted Data Affects <= 4.4.10 Patched in 4.4.11
  7. Patched Medium · 6.5 LearnPress <= 4.4.10 - Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via 'search-authors' AJAX Action ↗
    2026-10-16 CVE-2026-107744 Missing Authorization Affects <= 4.4.10 Patched in 4.4.11
  8. Patched High · 7.2 LearnPress <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' Parameters ↗
    2026-10-16 CVE-2026-109208 Improper Neutralization of Input During Web Page Generation Affects <= 4.4.10 Patched in 4.4.11
  9. Patched High · 7.2 LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.9 - Unauthenticated Stored Cross-Site Scripting ↗
    2026-10-05 CVE-2026-104670 Improper Neutralization of Input During Web Page Generation Affects <= 4.4.9 Patched in 4.4.9.1
  10. Patched Medium · 6.4 LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.9.1 - Authenticated (Instructor+) Stored Cross-Site Scripting ↗
    2026-10-05 CVE-2026-105397 Improper Neutralization of Input During Web Page Generation Affects <= 4.4.9.1 Patched in 4.4.10
  11. Open Medium · 4.3 LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.9.1 - Missing Authorization ↗
    2026-10-02 CVE-2026-39717 Missing Authorization Affects <= 4.4.9.1 No patch available
  12. Patched Medium · 6.1 LearnPress <= 4.4.7 - Reflected DOM-Based Cross-Site Scripting via 'orderby' Parameter ↗
    2026-10-02 CVE-2026-92538 Improper Neutralization of Input During Web Page Generation Affects <= 4.4.7 Patched in 4.4.8
  13. Patched Medium · 5.3 LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.9 - Unauthenticated Insecure Direct Object Reference ↗
    2026-10-02 CVE-2026-104403 Authorization Bypass Through User-Controlled Key Affects <= 4.4.9 Patched in 4.4.9.1
  14. Patched High · 7.5 LearnPress <= 4.4.8 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'item_id' Parameter ↗
    2026-09-30 CVE-2026-93882 Authorization Bypass Through User-Controlled Key Affects <= 4.4.8 Patched in 4.4.9
  15. Patched Medium · 5.3 LearnPress 4.4.3 - 4.4.6 - Unauthenticated Information Exposure ↗
    2026-09-15 CVE-2026-86446 Exposure of Sensitive Information to an Unauthorized Actor Affects 4.4.3 - 4.4.6 Patched in 4.4.7
  16. Patched Medium · 5.3 LearnPress <= 4.4.6 - Unauthenticated Information Exposure ↗
    2026-09-14 CVE-2026-86448 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 4.4.6 Patched in 4.4.7
  17. Patched Medium · 5.3 LearnPress <= 4.4.6 - Unauthenticated Information Exposure ↗
    2026-09-14 CVE-2026-86445 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 4.4.6 Patched in 4.4.7
  18. Patched Medium · 5.3 LearnPress <= 4.4.6 - Unauthenticated Information Exposure ↗
    2026-09-14 CVE-2026-86447 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 4.4.6 Patched in 4.4.7
  19. Patched Medium · 5.3 LearnPress <= 4.4.6 - Unauthenticated Information Exposure ↗
    2026-09-14 CVE-2026-86449 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 4.4.6 Patched in 4.4.7
  20. Patched Medium · 6.1 LearnPress <= 4.4.6 - Reflected Cross-Site Scripting ↗
    2026-09-14 CVE-2026-86444 Improper Neutralization of Input During Web Page Generation Affects <= 4.4.6 Patched in 4.4.7
  21. Patched Medium · 6.4 LearnPress <= 4.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'layout_custom_css' ↗
    2026-09-07 CVE-2026-12230 Improper Neutralization of Input During Web Page Generation Affects <= 4.3.9.1 Patched in 4.4.0
  22. Patched Medium · 4.3 LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.5 - Missing Authorization ↗
    2026-09-03 CVE-2026-82023 Missing Authorization Affects <= 4.4.5 Patched in 4.4.6
  23. Patched Medium · 6.4 LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.5 - Authenticated (Instructor+) Stored Cross-Site Scripting ↗
    2026-09-03 CVE-2026-82024 Improper Neutralization of Input During Web Page Generation Affects <= 4.4.5 Patched in 4.4.6
  24. Patched Medium · 4.9 LearnPress <= 4.4.4 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter ↗
    2026-08-31 CVE-2026-77823 Improper Neutralization of Special Elements used in an SQL Command Affects <= 4.4.4 Patched in 4.4.5
  25. Patched Medium · 4.4 LearnPress <= 4.4.4 - Missing Authorization to Authenticated (Editor+) Limited Option Update via 'field_name' Parameter ↗
    2026-08-24 CVE-2026-75982 Missing Authorization Affects <= 4.4.4 Patched in 4.4.5
  26. Patched Medium · 4.3 LearnPress – WordPress LMS Plugin for Create and Sell Online Courses < 4.4.4 - Authenticated (Subscriber+) Information Exposure ↗
    2026-08-13 CVE-2026-12976 Exposure of Sensitive Information to an Unauthorized Actor Affects < 4.4.4 Patched in 4.4.4
  27. Patched Medium · 6.4 LearnPress <= 4.4.3 - Authenticated (Instructor+) Server-Side Request Forgery ↗
    2026-08-06 CVE-2026-12971 Server-Side Request Forgery Affects <= 4.4.3 Patched in 4.4.4
  28. Patched High · 7.5 LearnPress <= 4.4.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure via /lp/v1/users/check-answer and /start-quiz REST Endpoints ↗
    2026-07-16 CVE-2026-13765 Missing Authorization Affects <= 4.4.1 Patched in 4.4.2
  29. Patched Medium · 6.4 LearnPress <= 4.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class_wrapper_form' Shortcode Attribute ↗
    2026-06-30 CVE-2026-12732 Improper Neutralization of Input During Web Page Generation Affects <= 4.4.0 Patched in 4.4.1
  30. Patched Medium · 6.5 LearnPress <= 4.3.9.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'userId' Parameter ↗
    2026-06-30 CVE-2026-11988 Authorization Bypass Through User-Controlled Key Affects <= 4.3.9.1 Patched in 4.4.0
  31. Patched Medium · 6.1 LearnPress <= 4.4.0 - Reflected Cross-Site Scripting ↗
    2026-06-29 CVE-2026-12970 Improper Neutralization of Input During Web Page Generation Affects <= 4.4.0 Patched in 4.4.1
  32. Patched Medium · 5.3 LearnPress <= 4.3.6 - Missing Authorization to Unauthenticated Sensitive User Information Disclosure ↗
    2026-06-27 CVE-2026-8383 Missing Authorization Affects <= 4.3.6 Patched in 4.3.7
  33. Patched Medium · 5.3 LearnPress <= 4.3.6 - Unauthenticated Sensitive Information Exposure via 'c_status' and 'return_type' Parameters ↗
    2026-06-05 CVE-2026-8502 Missing Authorization Affects <= 4.3.6 Patched in 4.3.7
  34. Patched Medium · 6.1 LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.6 - Reflected Cross-Site Scripting ↗
    2026-06-01 CVE-2026-48865 Improper Neutralization of Input During Web Page Generation Affects <= 4.3.6 Patched in 4.3.7
  35. Patched Medium · 4.3 LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.5 - Authenticated (Subscriber+) Payment Bypass to Free Course Enrollment via 'quantity' Parameter ↗
    2026-05-13 CVE-2026-7648 Authorization Bypass Through User-Controlled Key Affects <= 4.3.5 Patched in 4.3.6
  36. Patched Critical · 9.1 LearnPress <= 4.3.2.8 - Missing Authorization to Unauthenticated Arbitrary Quiz Answer Deletion ↗
    2026-04-13 CVE-2026-4365 Missing Authorization Affects <= 4.3.2.8 Patched in 4.3.3
  37. Patched Medium · 6.4 LearnPress <= 4.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'skin' Shortcode Attribute ↗
    2026-04-07 CVE-2026-4333 Improper Neutralization of Input During Web Page Generation Affects <= 4.3.3 Patched in 4.3.4
  38. Patched Medium · 4.3 LearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Answer Deletion ↗
    2026-03-23 CVE-2026-3225 Missing Authorization Affects <= 4.3.2.8 Patched in 4.3.3
  39. Patched Medium · 4.3 LearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Notification Triggering ↗
    2026-03-11 CVE-2026-3226 Missing Authorization Affects <= 4.3.2.8 Patched in 4.3.3
  40. Patched Medium · 5.3 LearnPress – WordPress LMS Plugin <= 4.3.2.4 - Missing Authorization to Unauthenticated Sensitive User Information Disclosure via REST API ↗
    2026-01-19 CVE-2025-14798 Missing Authorization Affects <= 4.3.2.4 Patched in 4.3.2.5
  41. Patched Medium · 5.4 LearnPress – WordPress LMS Plugin <= 4.3.2.2 - Insecure Direct Object Reference to Authenticated (Instructor+) Teacher Material Deletion ↗
    2026-01-06 CVE-2025-14802 Authorization Bypass Through User-Controlled Key Affects <= 4.3.2.1 Patched in 4.3.2.2
  42. Patched Medium · 5.3 LearnPress – WordPress LMS Plugin <= 4.3.2 - Missing Authentication to Unauthenticated Course Modification ↗
    2026-01-05 CVE-2025-13964 Missing Authorization Affects <= 4.3.2 Patched in 4.3.2.1
  43. Patched Medium · 5.3 LearnPress – WordPress LMS Plugin <= 4.3.1 - Missing Authorization to Unauthenticated Orders Statistics Exposure ↗
    2025-12-15 CVE-2025-13956 Missing Authorization Affects <= 4.3.1 Patched in 4.3.2
  44. Patched Medium · 6.4 LearnPress – WordPress LMS Plugin <= 4.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via get_profile_social ↗
    2025-12-15 CVE-2025-14387 Improper Neutralization of Input During Web Page Generation Affects <= 4.3.1 Patched in 4.3.2
  45. Patched Medium · 5.3 LearnPress <= 4.2.9.4 - Missing Authorization ↗
    2025-11-30 CVE-2025-66054 Missing Authorization Affects <= 4.2.9.4 Patched in 4.3.0
  46. Patched Medium · 5.3 LearnPress – WordPress LMS Plugin <= 4.2.9.4 - Missing Authorization to Unauthenticated Arbitrary Callback Execution to Information Exposure ↗
    2025-11-20 CVE-2025-11368 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 4.2.9.4 Patched in 4.3.0
  47. Patched Medium · 6.4 LearnPress <= 4.2.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2025-11-06 CVE-2025-67536 Improper Neutralization of Input During Web Page Generation Affects <= 4.2.9.4 Patched in 4.3.0
  48. Patched Medium · 6.5 LearnPress – WordPress LMS Plugin <= 4.2.9.3 - Missing Authorization to Unauthenticated Database Table Manipulation ↗
    2025-10-17 CVE-2025-11372 Missing Authorization Affects <= 4.2.9.3 Patched in 4.2.9.4
  49. Patched Medium · 5.3 LearnPress <= 4.2.7.5 - Missing Authorization ↗
    2025-03-27 CVE-2025-22739 Missing Authorization Affects <= 4.2.7.5 Patched in 4.2.7.6
  50. Patched Medium · 4.4 LearnPress – WordPress LMS Plugin <= 4.2.7.5 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2025-01-29 CVE-2024-13127 Improper Neutralization of Input During Web Page Generation Affects <= 4.2.7.5 Patched in 4.2.7.5.1
  51. Patched Medium · 4.4 LearnPress – WordPress LMS Plugin <= 4.2.7.5 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2025-01-29 CVE-2024-13128 Improper Neutralization of Input During Web Page Generation Affects <= 4.2.7.5 Patched in 4.2.7.5.1
  52. Patched Medium · 6.4 LearnPress – WordPress LMS Plugin <= 4.2.7.5 - Authenticated (LP Instructor+) Stored Cross-Site Scripting via Lesson Name ↗
    2025-01-24 CVE-2024-13599 Improper Neutralization of Input During Web Page Generation Affects <= 4.2.7.5 Patched in 4.2.7.5.1
  53. Patched Medium · 5.4 LearnPress <= 4.2.7.1 - Authenticated (Subscriber+) Open Redirect ↗
    2025-01-24 CVE-2025-24740 URL Redirection to Untrusted Site Affects <= 4.2.7.1 Patched in 4.2.7.2
  54. Patched Medium · 5.3 LearnPress – WordPress LMS Plugin <= 4.2.7.3 - Course Material Sensitive Information Exposure via REST API ↗
    2024-12-09 CVE-2024-11868 Improper Access Control Affects <= 4.2.7.3 Patched in 4.2.7.4
  55. Patched Medium · 4.4 LearnPress <= 4.2.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2024-11-21 CVE-2024-10010 Improper Neutralization of Input During Web Page Generation Affects <= 4.2.7.1 Patched in 4.2.7.2
  56. Patched Medium · 4.4 LearnPress <= 4.2.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2024-11-21 CVE-2024-9881 Improper Neutralization of Input During Web Page Generation Affects <= 4.2.7.1 Patched in 4.2.7.2
  57. Patched Critical · 10.0 LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_fields' ↗
    2024-09-11 CVE-2024-8529 Improper Neutralization of Special Elements used in an SQL Command Affects <= 4.2.7 Patched in 4.2.7.1
  58. Patched Critical · 10.0 LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_only_fields' ↗
    2024-09-11 CVE-2024-8522 Improper Neutralization of Special Elements used in an SQL Command Affects <= 4.2.7 Patched in 4.2.7.1
  59. Patched High · 8.8 LearnPress – WordPress LMS Plugin <= 4.2.6.9.3 - Authenticated (Contributor+) SQL Injection via order Parameter ↗
    2024-08-07 CVE-2024-7548 Improper Neutralization of Special Elements used in an SQL Command Affects <= 4.2.6.9.3 Patched in 4.2.6.9.4
  60. Patched Medium · 4.3 LearnPress <= 4.2.6.8.2 - Cross-Site Request Forgery ↗
    2024-08-01 CVE-2024-39641 Cross-Site Request Forgery Affects <= 4.2.6.8.2 Patched in 4.2.6.9
  61. Patched Medium · 5.4 LearnPress <= 4.2.6.8.2 - Authenticated (Subscriber+) Insecure Direct Object Reference ↗
    2024-08-01 CVE-2024-39642 Authorization Bypass Through User-Controlled Key Affects <= 4.2.6.8.2 Patched in 4.2.6.9
  62. Patched High · 8.8 LearnPress <= 4.2.6.8.2 - Authenticated (Contributor+) Local File Inclusion ↗
    2024-07-24 CVE-2024-6589 Improper Control of Filename for Include/Require Statement in PHP Program Affects <= 4.2.6.8.2 Patched in 4.2.6.9
  63. Patched Medium · 5.3 LearnPress – WordPress LMS Plugin <= 4.2.6.8.1 - Missing Authorization to Unauthenticated User Registration Bypass ↗
    2024-07-01 CVE-2024-6088 Missing Authorization Affects <= 4.2.6.8.1 Patched in 4.2.6.8.2
  64. Patched Medium · 5.3 LearnPress – WordPress LMS Plugin <= 4.2.6.8.1 - Unauthenticated Bypass to User Registration ↗
    2024-07-01 CVE-2024-6099 Unprotected Alternate Channel Affects <= 4.2.6.8.1 Patched in 4.2.6.8.2
  65. Patched Medium · 5.3 LearnPress – WordPress LMS Plugin <= 4.2.6.8 - Basic Information Disclosure via JSON API ↗
    2024-06-04 CVE-2024-5483 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 4.2.6.8 Patched in 4.2.6.8.1
  66. Patched Medium · 6.4 LearnPress – WordPress LMS Plugin <= 4.2.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter ↗
    2024-05-21 CVE-2024-4971 Improper Neutralization of Input During Web Page Generation Affects <= 4.2.6.6 Patched in 4.2.6.7
  67. Patched Medium · 6.4 LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via layout_html Parameter ↗
    2024-05-09 CVE-2024-4277 Improper Neutralization of Input During Web Page Generation Affects <= 4.2.6.5 Patched in 4.2.6.6
  68. Patched Critical · 9.8 LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Time-Based SQL Injection ↗
    2024-05-09 CVE-2024-4434 Improper Neutralization of Special Elements used in an SQL Command Affects <= 4.2.6.5 Patched in 4.2.6.6
  69. Patched Medium · 5.3 LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Bypass to User Registration ↗
    2024-05-09 CVE-2024-4444 Unprotected Alternate Channel Affects <= 4.2.6.5 Patched in 4.2.6.6
  70. Patched High · 8.8 LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Authenticated (Instructor+) Arbitrary File Upload ↗
    2024-05-09 CVE-2024-4397 Unrestricted Upload of File with Dangerous Type Affects <= 4.2.6.5 Patched in 4.2.6.6
  71. Patched Medium · 6.4 LearnPress – WordPress LMS Plugin <= 4.2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2024-04-18 CVE-2024-3560 Improper Neutralization of Input During Web Page Generation Affects <= 4.2.6.4 Patched in 4.2.6.5
  72. Patched Medium · 6.5 LearnPress <= 4.2.6.3 - Insecure Direct Object Reference ↗
    2024-04-04 CVE-2024-1289 Improper Authorization Affects <= 4.2.6.3 Patched in 4.2.6.4
  73. Patched High · 8.8 LearnPress – WordPress LMS Plugin <= 4.0.0 - Cross-Site Request Forgery to Privilege Escalation ↗
    2024-04-04 CVE-2024-2115 Cross-Site Request Forgery Affects <= 4.0.0 Patched in 4.0.1
  74. Patched Medium · 4.4 LearnPress <= 4.2.6.3 - Authenticated(LP Instructor+) Stored Cross-Site Scripting ↗
    2024-04-04 CVE-2024-1463 Improper Neutralization of Input During Web Page Generation Affects <= 4.2.6.3 Patched in 4.2.6.4
  75. Patched High · 8.1 LearnPress <= 4.2.5.7 - Command Injection ↗
    2024-01-03 CVE-2023-6634 Improper Neutralization of Argument Delimiters in a Command Affects <= 4.2.5.7 Patched in 4.2.5.8
  76. Patched Medium · 4.3 LearnPress <= 4.2.5.7 - Insecure Direct Object Reference to Information Disclosure ↗
    2024-01-02 CVE-2023-6223 Authorization Bypass Through User-Controlled Key Affects <= 4.2.5.7 Patched in 4.2.5.8
  77. Patched Critical · 9.8 LearnPress <= 4.2.5.7 - Unauthenticated SQL Injection via order_by ↗
    2024-01-02 CVE-2023-6567 Improper Neutralization of Special Elements used in an SQL Command Affects <= 4.2.5.7 Patched in 4.2.5.8
  78. Patched Medium · 6.1 LearnPress <= 4.2.5.3 - Reflected Cross-Site Scripting via add_internal_scripts_to_head ↗
    2023-11-07 CVE-2023-5558 Improper Neutralization of Input During Web Page Generation Affects < 4.2.5.4 Patched in 4.2.5.4
  79. Patched Medium · 5.4 LearnPress <= 4.2.3 - Missing Authorization ↗
    2023-07-06 Missing Authorization Affects < 4.2.3.1 Patched in 4.2.3.1
  80. Patched Medium · 5.4 LearnPress <= 4.2.3 - Missing Authorization ↗
    2023-07-04 CVE-2023-36516 Missing Authorization Affects <= 4.2.3 Patched in 4.2.3.1
  81. Patched High · 7.3 LearnPress <= 4.2.3 - Missing Authorization to Information Exposure ↗
    2023-07-04 CVE-2023-36515 Missing Authorization Affects <= 4.2.3 Patched in 4.2.3.1
  82. Patched Critical · 9.8 LearnPress <= 4.1.7.3.2 - Unauthenticated SQL Injection ↗
    2023-01-20 CVE-2022-45808 Improper Neutralization of Special Elements used in an SQL Command Affects <= 4.1.7.3.2 Patched in 4.2.0
  83. Patched Critical · 9.8 LearnPress <= 4.1.7.3.2 - Unauthenticated Local File Inclusion ↗
    2023-01-20 CVE-2022-47615 Improper Limitation of a Pathname to a Restricted Directory Affects <= 4.1.7.3.2 Patched in 4.2.0
  84. Patched High · 8.8 LearnPress <= 4.1.7.3.2 - Authenticated (Subscriber+) SQL Injection ↗
    2022-12-20 CVE-2022-45820 Improper Neutralization of Special Elements used in an SQL Command Affects <= 4.1.7.3.2 Patched in 4.2.0
  85. Patched Critical · 9.8 LearnPress <= 4.1.7.1 - Unauthenticated PHP Object Injection ↗
    2022-10-03 CVE-2022-3360 Deserialization of Untrusted Data Affects <= 4.1.7.1 Patched in 4.1.7.2
  86. Patched Medium · 6.1 LearnPress – WordPress LMS Plugin <= 4.1.6.7 - Reflected Cross-Site Scripting ↗
    2022-07-05 Improper Neutralization of Input During Web Page Generation Affects <= 4.1.6.7 Patched in 4.1.6.8
  87. Patched Medium · 6.1 LearnPress – WordPress LMS Plugin <= 4.1.6.5 - Reflected Cross-Site Scripting ↗
    2022-06-14 Improper Neutralization of Input During Web Page Generation Affects <= 4.1.6.5 Patched in 4.1.6.6
  88. Patched Medium · 6.1 LearnPress <= 4.1.5 - Reflected Cross-Site Scripting ↗
    2022-03-16 CVE-2022-0271 Improper Neutralization of Input During Web Page Generation Affects < 4.1.6 Patched in 4.1.6
  89. Patched Medium · 4.3 LearnPress <= 4.1.4.1 - Arbitrary Image Renaming ↗
    2022-01-26 CVE-2022-0377 External Control of File Name or Path Affects <= 4.1.4.1 Patched in 4.1.5
  90. Patched Critical · 9.8 LearnPress <= 4.1.3 - Authenticated SQL Injection ↗
    2021-11-09 CVE-2021-24951 Improper Neutralization of Special Elements used in an SQL Command Affects < 4.1.4 Patched in 4.1.4
  91. Patched Medium · 5.5 LearnPress <= 4.1.3.1 - Stored Cross-Site Scripting via $custom_profile ↗
    2021-10-18 CVE-2021-39348 Improper Neutralization of Input During Web Page Generation Affects <= 4.1.3.1 Patched in 4.1.3.2
  92. Patched Medium · 4.8 LearnPress <= 4.1.3 - Authenticated Stored Cross-Site Scripting ↗
    2021-09-20 CVE-2021-24702 Improper Neutralization of Input During Web Page Generation Affects <= 4.1.3 Patched in 4.1.3.1
  93. Patched High · 8.8 LearnPress <= 3.2.6.7 - SQL Injection ↗
    2021-07-19 CVE-2020-6010 Improper Neutralization of Special Elements used in an SQL Command Affects <= 3.2.6.7 Patched in 3.2.6.8
  94. Patched High · 8.8 LearnPress – WordPress LMS Plugin <= 3.2.7.2 - SQL Injection ↗
    2020-10-05 Improper Neutralization of Special Elements used in an SQL Command Affects <= 3.2.7.2 Patched in 3.2.7.3
  95. Patched Medium · 6.1 LearnPress <= 3.2.7.2 - Reflected Cross-Site Scripting ↗
    2020-09-08 Improper Neutralization of Input During Web Page Generation Affects < 3.2.7.3 Patched in 3.2.7.3
  96. Patched High · 8.1 LearnPress <= 3.2.6.8 - Privilege Escalation via accept-to-be-teacher action parameter ↗
    2020-04-20 CVE-2020-11511 Improper Privilege Management Affects <= 3.2.6.8 Patched in 3.2.6.9
  97. Patched High · 7.1 LearnPress <= 3.2.6.8 - Authenticated Page Creation and Status Modification ↗
    2020-04-19 CVE-2020-11510 Improper Privilege Management Affects <= 3.2.6.8 Patched in 3.2.6.9
  98. Patched High · 7.1 LearnPress <= 3.2.6.6 - Privilege Escalation ↗
    2020-03-16 CVE-2020-7916 Improper Privilege Management Affects <= 3.2.6.6 Patched in 3.2.6.8
  99. Patched High · 7.2 LearnPress <= 3.0.12 - Authenticated SQL Injection ↗
    2018-11-09 CVE-2018-16175 Improper Neutralization of Special Elements used in an SQL Command Affects <= 3.0.12 Patched in 3.1.0
  100. Patched Medium · 6.1 LearnPress <= 3.0.12 - Open Redirect ↗
    2018-11-09 CVE-2018-16174 URL Redirection to Untrusted Site Affects <= 3.0.12 Patched in 3.1.0
  101. Patched Medium · 6.1 LearnPress <= 3.0.12 - Cross-Site Scripting ↗
    2018-11-09 CVE-2018-16173 Improper Neutralization of Input During Web Page Generation Affects <= 3.0.12 Patched in 3.1.0

Vulnerability records provided by Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. License and terms.

CVE records: Copyright 1999-2026 The MITRE Corporation. CVE terms of use.

Behavioral tests

via WP Hive

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0.1

✓ Low memory footprint
✓ Low page-speed impact
✕ Runs on latest PHP + WP
✕ No PHP errors
✓ No JS errors
✓ Activates cleanly
✓ No resource errors
✓ No external HTTP errors
✓ Optimized database use
✓ Frequently updated

Languages

via translate.wordpress.org

Translated into 128 languages, 5 at 90% or more

English (UK) 100%
Serbian 100%
Lao 97%
Spanish (Mexico) 97%
Romanian 96%
Polish 87%
Arabic 83%
Korean 67%
Slovenian 62%
Russian 60%
Spanish (Spain) 58%
Spanish (Chile) 55%
Dutch 54%
Dutch (Belgium) 54%
Turkish 51%
Czech 50%
Slovak 50%
Spanish (Ecuador) 49%
Spanish (Costa Rica) 48%
Spanish (Colombia) 45%
Persian 43%
Italian 38%
Swedish 35%
German 34%

Plus 104 more locales with partial translations.

AI assistants

How it's measured →

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Not measured yet for this plugin’s topics. Its tracked searches are not among the measured topics. See the topics measured so far.

Readme readiness

8 of 8 pass · checked 26 Oct 2026

Can an assistant quote this readme? Eight deterministic checks over the wp.org listing, no model involved.

  • ✓ Says what it does "A WordPress LMS Plugin to create WordPress Learning Management System. Turn your WordPress to LMS WordPress..."
  • ✓ Has a FAQ 8 questions in the FAQ.
  • ✓ FAQ asks real questions 8 of 8 read like questions a user would type.
  • ✓ Names who it is for Names its audience or use cases ("if you have", "perfect for").
  • ✓ Names what it works with Mentions WooCommerce, Elementor, Gutenberg, Block editor and 9 more.
  • ✓ Headings and lists 13 headings and 9 lists.
  • ✓ Enough to quote 15,605 characters of description.
  • ✓ Tags match the text 4 of 5 tags appear in the text; "elearning" does not.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

  1. 2026-05-15 80K+ → 70K+ down after 223 days in tier
  2. 2025-10-04 90K+ → 80K+ down after 818 days in tier
  3. 2023-07-09 100K+ → 90K+ down after 919 days in tier
  4. 2021-01-01 90K+ → 100K+ up after 198 days in tier
  5. 2020-06-17 80K+ → 90K+ up after 51 days in tier
  6. 2020-04-27 70K+ → 80K+ up after 137 days in tier
  7. 2019-12-12 60K+ → 70K+ up after 255 days in tier
  8. 2019-04-01 50K+ → 60K+ up after 151 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for LearnPress – WordPress LMS Plugin for Create and Sell Online Courses into a readme, a review or a deck. It updates itself.

<iframe src="https://plugins.wpmayor.com/embed/learnpress" width="480" height="300" style="border:0" loading="lazy" title="LearnPress – WordPress LMS Plugin for Create and Sell Online Courses — Plugin Pulse"></iframe>
Preview card ↗

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses: 70K+ active installs, 4.3★ (597 reviews). Plugin Pulse (WP Mayor), as of 2026-10-31. https://plugins.wpmayor.com/plugin/learnpress

Spotted a number that looks wrong? Report a data issue and we'll check it against the source.