LearnPress – WordPress LMS Plugin for Create and Sell Online Courses

84 Quality Score

Active Installs

22/30

With 70,000 active installs, LearnPress has a solid user base, though it sits well behind Tutor LMS at 100,000 and LearnDash in raw adoption.

Update Freshness

25/25

The plugin was updated in July 2026, which is very recent, and it requires PHP 7.4 and WordPress 6.0, indicating active upkeep.

User Rating

13/15

A rating of 86 out of 100 from 594 reviews is respectable and slightly above the category average for LMS plugins.

Support Health

9/15

Support threads are a clear weak spot, with only 1 of 6 reported threads resolved, giving a support health score of just 50.

WP Compatibility

15/15

A perfect compatibility score is earned by being tested up to WordPress 7.0.1 and supporting modern PHP versions, signalling broad site compatibility.

Scores higher than 93% of indexed plugins

About

A WordPress LMS Plugin to create WordPress Learning Management System. Turn your WordPress to LMS WordPress Website with Courses, Lessons, Quizzes &am …

Active Installs 70k+

Rating ★★★★ 4.3/5

Last Updated 2026-09-18 11:22am GMT

Requires WordPress 6.0+

Tested Up To 7.1.1

Requires PHP 7.4+

Security History

87 known vulnerabilities, all patched

9 Critical 14 High 64 Medium

Most recent: September 15, 2026

View details ▸

LearnPress 4.4.3 - 4.4.6 - Unauthenticated Information Exposure Medium

September 15, 2026 Patched in ["4.4.7"] CVE-2026-86446

LearnPress <= 4.4.6 - Unauthenticated Information Exposure Medium

September 14, 2026 Patched in ["4.4.7"] CVE-2026-86448

LearnPress <= 4.4.6 - Unauthenticated Information Exposure Medium

September 14, 2026 Patched in ["4.4.7"] CVE-2026-86445

LearnPress <= 4.4.6 - Unauthenticated Information Exposure Medium

September 14, 2026 Patched in ["4.4.7"] CVE-2026-86447

LearnPress <= 4.4.6 - Unauthenticated Information Exposure Medium

September 14, 2026 Patched in ["4.4.7"] CVE-2026-86449

LearnPress <= 4.4.6 - Reflected Cross-Site Scripting Medium

September 14, 2026 Patched in ["4.4.7"] CVE-2026-86444

LearnPress <= 4.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'layout_custom_css' Medium

September 7, 2026 Patched in ["4.4.0"] CVE-2026-12230

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.5 - Missing Authorization Medium

September 3, 2026 Patched in ["4.4.6"] CVE-2026-82023

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.4.5 - Authenticated (Instructor+) Stored Cross-Site Scripting Medium

September 3, 2026 Patched in ["4.4.6"] CVE-2026-82024

LearnPress <= 4.4.4 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter Medium

August 31, 2026 Patched in ["4.4.5"] CVE-2026-77823

LearnPress <= 4.4.4 - Missing Authorization to Authenticated (Editor+) Limited Option Update via 'field_name' Parameter Medium

August 24, 2026 Patched in ["4.4.5"] CVE-2026-75982

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses < 4.4.4 - Authenticated (Subscriber+) Information Exposure Medium

August 13, 2026 Patched in ["4.4.4"] CVE-2026-12976

LearnPress <= 4.4.3 - Authenticated (Instructor+) Server-Side Request Forgery Medium

August 6, 2026 Patched in ["4.4.4"] CVE-2026-12971

LearnPress <= 4.4.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure via /lp/v1/users/check-answer and /start-quiz REST Endpoints High

July 16, 2026 Patched in ["4.4.2"] CVE-2026-13765

LearnPress <= 4.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class_wrapper_form' Shortcode Attribute Medium

June 30, 2026 Patched in ["4.4.1"] CVE-2026-12732

LearnPress <= 4.3.9.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'userId' Parameter Medium

June 30, 2026 Patched in ["4.4.0"] CVE-2026-11988

LearnPress <= 4.4.0 - Reflected Cross-Site Scripting Medium

June 29, 2026 Patched in ["4.4.1"] CVE-2026-12970

LearnPress <= 4.3.6 - Missing Authorization to Unauthenticated Sensitive User Information Disclosure Medium

June 27, 2026 Patched in ["4.3.7"] CVE-2026-8383

LearnPress <= 4.3.6 - Unauthenticated Sensitive Information Exposure via 'c_status' and 'return_type' Parameters Medium

June 5, 2026 Patched in ["4.3.7"] CVE-2026-8502

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.6 - Reflected Cross-Site Scripting Medium

June 1, 2026 Patched in ["4.3.7"] CVE-2026-48865

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.5 - Authenticated (Subscriber+) Payment Bypass to Free Course Enrollment via 'quantity' Parameter Medium

May 13, 2026 Patched in ["4.3.6"] CVE-2026-7648

LearnPress <= 4.3.2.8 - Missing Authorization to Unauthenticated Arbitrary Quiz Answer Deletion Critical

April 13, 2026 Patched in ["4.3.3"] CVE-2026-4365

LearnPress <= 4.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'skin' Shortcode Attribute Medium

April 7, 2026 Patched in ["4.3.4"] CVE-2026-4333

LearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Answer Deletion Medium

March 23, 2026 Patched in ["4.3.3"] CVE-2026-3225

LearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Notification Triggering Medium

March 11, 2026 Patched in ["4.3.3"] CVE-2026-3226

LearnPress – WordPress LMS Plugin <= 4.3.2.4 - Missing Authorization to Unauthenticated Sensitive User Information Disclosure via REST API Medium

January 19, 2026 Patched in ["4.3.2.5"] CVE-2025-14798

LearnPress – WordPress LMS Plugin <= 4.3.2.2 - Insecure Direct Object Reference to Authenticated (Instructor+) Teacher Material Deletion Medium

January 6, 2026 Patched in ["4.3.2.2"] CVE-2025-14802

LearnPress – WordPress LMS Plugin <= 4.3.2 - Missing Authentication to Unauthenticated Course Modification Medium

January 5, 2026 Patched in ["4.3.2.1"] CVE-2025-13964

LearnPress – WordPress LMS Plugin <= 4.3.1 - Missing Authorization to Unauthenticated Orders Statistics Exposure Medium

December 15, 2025 Patched in ["4.3.2"] CVE-2025-13956

LearnPress – WordPress LMS Plugin <= 4.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via get_profile_social Medium

December 15, 2025 Patched in ["4.3.2"] CVE-2025-14387

LearnPress <= 4.2.9.4 - Missing Authorization Medium

November 30, 2025 Patched in ["4.3.0"] CVE-2025-66054

LearnPress – WordPress LMS Plugin <= 4.2.9.4 - Missing Authorization to Unauthenticated Arbitrary Callback Execution to Information Exposure Medium

November 20, 2025 Patched in ["4.3.0"] CVE-2025-11368

LearnPress <= 4.2.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting Medium

November 6, 2025 Patched in ["4.3.0"] CVE-2025-67536

LearnPress – WordPress LMS Plugin <= 4.2.9.3 - Missing Authorization to Unauthenticated Database Table Manipulation Medium

October 17, 2025 Patched in ["4.2.9.4"] CVE-2025-11372

LearnPress <= 4.2.7.5 - Missing Authorization Medium

March 27, 2025 Patched in ["4.2.7.6"] CVE-2025-22739

LearnPress – WordPress LMS Plugin <= 4.2.7.5 - Authenticated (Admin+) Stored Cross-Site Scripting Medium

January 29, 2025 Patched in ["4.2.7.5.1"] CVE-2024-13127

LearnPress – WordPress LMS Plugin <= 4.2.7.5 - Authenticated (Admin+) Stored Cross-Site Scripting Medium

January 29, 2025 Patched in ["4.2.7.5.1"] CVE-2024-13128

LearnPress – WordPress LMS Plugin <= 4.2.7.5 - Authenticated (LP Instructor+) Stored Cross-Site Scripting via Lesson Name Medium

January 24, 2025 Patched in ["4.2.7.5.1"] CVE-2024-13599

LearnPress <= 4.2.7.1 - Authenticated (Subscriber+) Open Redirect Medium

January 24, 2025 Patched in ["4.2.7.2"] CVE-2025-24740

LearnPress – WordPress LMS Plugin <= 4.2.7.3 - Course Material Sensitive Information Exposure via REST API Medium

December 9, 2024 Patched in ["4.2.7.4"] CVE-2024-11868

LearnPress <= 4.2.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting Medium

November 21, 2024 Patched in ["4.2.7.2"] CVE-2024-10010

LearnPress <= 4.2.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting Medium

November 21, 2024 Patched in ["4.2.7.2"] CVE-2024-9881

LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_fields' Critical

September 11, 2024 Patched in ["4.2.7.1"] CVE-2024-8529

LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_only_fields' Critical

September 11, 2024 Patched in ["4.2.7.1"] CVE-2024-8522

LearnPress – WordPress LMS Plugin <= 4.2.6.9.3 - Authenticated (Contributor+) SQL Injection via order Parameter High

August 7, 2024 Patched in ["4.2.6.9.4"] CVE-2024-7548

LearnPress <= 4.2.6.8.2 - Cross-Site Request Forgery Medium

August 1, 2024 Patched in ["4.2.6.9"] CVE-2024-39641

LearnPress <= 4.2.6.8.2 - Authenticated (Subscriber+) Insecure Direct Object Reference Medium

August 1, 2024 Patched in ["4.2.6.9"] CVE-2024-39642

LearnPress <= 4.2.6.8.2 - Authenticated (Contributor+) Local File Inclusion High

July 24, 2024 Patched in ["4.2.6.9"] CVE-2024-6589

LearnPress – WordPress LMS Plugin <= 4.2.6.8.1 - Missing Authorization to Unauthenticated User Registration Bypass Medium

July 1, 2024 Patched in ["4.2.6.8.2"] CVE-2024-6088

LearnPress – WordPress LMS Plugin <= 4.2.6.8.1 - Unauthenticated Bypass to User Registration Medium

July 1, 2024 Patched in ["4.2.6.8.2"] CVE-2024-6099

LearnPress – WordPress LMS Plugin <= 4.2.6.8 - Basic Information Disclosure via JSON API Medium

June 4, 2024 Patched in ["4.2.6.8.1"] CVE-2024-5483

LearnPress – WordPress LMS Plugin <= 4.2.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter Medium

May 21, 2024 Patched in ["4.2.6.7"] CVE-2024-4971

LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via layout_html Parameter Medium

May 9, 2024 Patched in ["4.2.6.6"] CVE-2024-4277

LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Time-Based SQL Injection Critical

May 9, 2024 Patched in ["4.2.6.6"] CVE-2024-4434

LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Bypass to User Registration Medium

May 9, 2024 Patched in ["4.2.6.6"] CVE-2024-4444

LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Authenticated (Instructor+) Arbitrary File Upload High

May 9, 2024 Patched in ["4.2.6.6"] CVE-2024-4397

LearnPress – WordPress LMS Plugin <= 4.2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting Medium

April 18, 2024 Patched in ["4.2.6.5"] CVE-2024-3560

LearnPress <= 4.2.6.3 - Insecure Direct Object Reference Medium

April 4, 2024 Patched in ["4.2.6.4"] CVE-2024-1289

LearnPress – WordPress LMS Plugin <= 4.0.0 - Cross-Site Request Forgery to Privilege Escalation High

April 4, 2024 Patched in ["4.0.1"] CVE-2024-2115

LearnPress <= 4.2.6.3 - Authenticated(LP Instructor+) Stored Cross-Site Scripting Medium

April 4, 2024 Patched in ["4.2.6.4"] CVE-2024-1463

LearnPress <= 4.2.5.7 - Command Injection High

January 3, 2024 Patched in ["4.2.5.8"] CVE-2023-6634

LearnPress <= 4.2.5.7 - Insecure Direct Object Reference to Information Disclosure Medium

January 2, 2024 Patched in ["4.2.5.8"] CVE-2023-6223

LearnPress <= 4.2.5.7 - Unauthenticated SQL Injection via order_by Critical

January 2, 2024 Patched in ["4.2.5.8"] CVE-2023-6567

LearnPress <= 4.2.5.3 - Reflected Cross-Site Scripting via add_internal_scripts_to_head Medium

November 7, 2023 Patched in ["4.2.5.4"] CVE-2023-5558

LearnPress <= 4.2.3 - Missing Authorization Medium

July 6, 2023 Patched in ["4.2.3.1"]

LearnPress <= 4.2.3 - Missing Authorization Medium

July 4, 2023 Patched in ["4.2.3.1"] CVE-2023-36516

LearnPress <= 4.2.3 - Missing Authorization to Information Exposure High

July 4, 2023 Patched in ["4.2.3.1"] CVE-2023-36515

LearnPress <= 4.1.7.3.2 - Unauthenticated SQL Injection Critical

January 20, 2023 Patched in ["4.2.0"] CVE-2022-45808

LearnPress <= 4.1.7.3.2 - Unauthenticated Local File Inclusion Critical

January 20, 2023 Patched in ["4.2.0"] CVE-2022-47615

LearnPress <= 4.1.7.3.2 - Authenticated (Subscriber+) SQL Injection High

December 20, 2022 Patched in ["4.2.0"] CVE-2022-45820

LearnPress <= 4.1.7.1 - Unauthenticated PHP Object Injection Critical

October 3, 2022 Patched in ["4.1.7.2"] CVE-2022-3360

LearnPress – WordPress LMS Plugin <= 4.1.6.7 - Reflected Cross-Site Scripting Medium

July 5, 2022 Patched in ["4.1.6.8"]

LearnPress – WordPress LMS Plugin <= 4.1.6.5 - Reflected Cross-Site Scripting Medium

June 14, 2022 Patched in ["4.1.6.6"]

LearnPress <= 4.1.5 - Reflected Cross-Site Scripting Medium

March 16, 2022 Patched in ["4.1.6"] CVE-2022-0271

LearnPress <= 4.1.4.1 - Arbitrary Image Renaming Medium

January 26, 2022 Patched in ["4.1.5"] CVE-2022-0377

LearnPress <= 4.1.3 - Authenticated SQL Injection Critical

November 9, 2021 Patched in ["4.1.4"] CVE-2021-24951

LearnPress <= 4.1.3.1 - Stored Cross-Site Scripting via $custom_profile Medium

October 18, 2021 Patched in ["4.1.3.2"] CVE-2021-39348

LearnPress <= 4.1.3 - Authenticated Stored Cross-Site Scripting Medium

September 20, 2021 Patched in ["4.1.3.1"] CVE-2021-24702

LearnPress <= 3.2.6.7 - SQL Injection High

July 19, 2021 Patched in ["3.2.6.8"] CVE-2020-6010

LearnPress – WordPress LMS Plugin <= 3.2.7.2 - SQL Injection High

October 5, 2020 Patched in ["3.2.7.3"]

LearnPress <= 3.2.7.2 - Reflected Cross-Site Scripting Medium

September 8, 2020 Patched in ["3.2.7.3"]

LearnPress <= 3.2.6.8 - Privilege Escalation via accept-to-be-teacher action parameter High

April 20, 2020 Patched in ["3.2.6.9"] CVE-2020-11511

LearnPress <= 3.2.6.8 - Authenticated Page Creation and Status Modification High

April 19, 2020 Patched in ["3.2.6.9"] CVE-2020-11510

LearnPress <= 3.2.6.6 - Privilege Escalation High

March 16, 2020 Patched in ["3.2.6.8"] CVE-2020-7916

LearnPress <= 3.0.12 - Authenticated SQL Injection High

November 9, 2018 Patched in ["3.1.0"] CVE-2018-16175

LearnPress <= 3.0.12 - Open Redirect Medium

November 9, 2018 Patched in ["3.1.0"] CVE-2018-16174

LearnPress <= 3.0.12 - Cross-Site Scripting Medium

November 9, 2018 Patched in ["3.1.0"] CVE-2018-16173

What It Does

LearnPress turns a WordPress site into a full learning management system where you can build courses, organize lessons, and create quizzes for students. It supports selling courses through payment gateways, issuing certificates, and tracking student progress. It is one of the more established free LMS options in the WordPress ecosystem.

Who It's For

This plugin fits educators, coaches, and small-to-medium training businesses who want to sell courses directly on WordPress without paying for a SaaS platform like Teachable. It is well suited to sites that need a flexible course builder with quizzes and certificates, and developers comfortable extending the plugin with add-ons.

Who Should Skip It

If you need a tightly polished, out-of-the-box experience with minimal configuration, you may want to look at Tutor LMS or LearnDash instead. Sites that only need simple quiz functionality without full course management are also better served by a lighter plugin like Quiz Maker.

The Bottom Line

LearnPress scores 82.1 out of 100, placing it as a competent but not top-tier LMS, weighed down significantly by poor support resolution rates. It is a legitimate free alternative for course creators willing to invest time in configuration and third-party add-ons. The combination of strong maintenance, modern compatibility, and a large user base makes it safe to try, but buyers should budget for paid extensions to unlock the best features.

Related Plugins

Quiz Maker by AYS 88/100

Pick Quiz Maker if your primary need is standalone quizzes and assessments rather than a full course platform.

Masteriyo LMS 86/100

Choose Masteriyo if you want a newer, cleaner LMS interface with a modern builder and are starting from scratch with fewer than 5,000 users on similar plugins.

Tutor LMS 85/100

Pick Tutor LMS if you want a larger install base, a more polished front-end experience, and stronger out-of-the-box design templates.

Interactive Content – H5P 83/100

Choose H5P if your priority is rich interactive content like videos, drag-and-drop, and branching scenarios rather than full course commerce.

Uncanny Toolkit for LearnDash 81/100

Pick this toolkit only if you are already running LearnDash and need to extend it with features like group management and certificates.

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses

About

Security History

What It Does

Who It's For

Who Should Skip It

The Bottom Line

Related Plugins

Tags