Where
-Infinity
0

Trending

Last week
Last month
Last year

Vendor Risk Score

See how vibethemes compares to other vendors in security performance

View Risk Score →

VibeThemes WPLMSWordPress WPLMS plugin <= 1.9.9.5.4 - Arbitrary File Deletion vulnerability

Risk 49
Severity
8.6
Path Traversal
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in VibeThemes WPLMS wplmsplugin allows Path Traversal.This issue affects WPLMS: from n/a through <= 1.9.9.5.4.

First published (updated )
CVE-2025-69097

VibeThemes WPLMSWordPress WPLMS plugin <= 1.9.9.5.4 - Cross Site Scripting (XSS) vulnerability

Risk 46
Severity
6.5
XSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VibeThemes WPLMS wplmsplugin allows DOM-Based XSS.This issue affects WPLMS: from n/a through <= 1.9.9.5.4.

First published (updated )
CVE-2025-63035

VibeThemes WPLMSWordPress WPLMS plugin <= 1.9.9.8 - Cross Site Scripting (XSS) vulnerability

Risk 50
Severity
7.1
XSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VibeThemes WPLMS wplmsplugin allows Reflected XSS.This issue affects WPLMS: from n/a through <= 1.9.9.8.

First published (updated )
CVE-2025-53420

VibeThemes WPLMSWordPress WPLMS plugin <= 1.9.9.7 - Broken Access Control vulnerability

Risk 43
Severity
7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Missing Authorization vulnerability in VibeThemes WPLMS wplmsplugin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPLMS: from n/a through <= 1.9.9.7.

First published (updated )
CVE-2025-49925

VibeThemes WPLMSWordPress WPLMS theme <= 4.970 - Broken Access Control vulnerability

Risk 86
Severity
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Missing Authorization vulnerability in VibeThemes WPLMS wplms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPLMS : from n/a through <= 4.970.

First published (updated )
CVE-2025-58668

VibeThemes WPLMSWordPress WPLMS plugin < 1.9.9.5 - Unauthenticated Arbitrary Directory Deletion vulnerability

Risk 44
Severity
9.3
Path Traversal
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H

Path Traversal: '.../...//' vulnerability in VibeThemes WPLMS wplmsplugin allows Path Traversal.This issue affects WPLMS: from n/a through < 1.9.9.5.

Remedy

Update the WordPress WPLMS plugin to the latest available version (at least 1.9.9.5).
First published (updated )
CVE-2024-56045

VibeThemes WPLMSWordPress WPLMS plugin <= 1.9.9 - Unauthenticated Arbitrary User Token Generation vulnerability

Risk 46
Severity
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Authentication Bypass Using an Alternate Path or Channel vulnerability in VibeThemes WPLMS wplmsplugin allows Authentication Bypass.This issue affects WPLMS: from n/a through <= 1.9.9.

Remedy

Update the WordPress WPLMS plugin to the latest available version (at least 1.9.9.1).
First published (updated )
CVE-2024-56044

VibeThemes WPLMSWordPress WPLMS plugin <= 1.9.9 - Unauthenticated Privilege Escalation vulnerability

Risk 46
Severity
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Incorrect Privilege Assignment vulnerability in VibeThemes WPLMS wplmsplugin allows Privilege Escalation.This issue affects WPLMS: from n/a through <= 1.9.9.

Remedy

Update the WordPress WPLMS plugin to the latest available version (at least 1.9.9.1).
First published (updated )
CVE-2024-56043

VibeThemes VibeBPWordPress VibeBP plugin <= 1.9.9.4.1 - Unauthenticated Privilege Escalation vulnerability

Risk 46
Severity
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Incorrect Privilege Assignment vulnerability in VibeThemes VibeBP vibebp allows Privilege Escalation.This issue affects VibeBP: from n/a through <= 1.9.9.4.1.

Remedy

Update the WordPress VibeBP plugin to the latest available version (at least 1.9.9.5).
First published (updated )
CVE-2024-56040

VibeThemes WPLMSWordPress WPLMS plugin < 1.9.9.5.3 - Unauthenticated SQL Injection vulnerability

Risk 86
Severity
9.8
SQL Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplmsplugin allows SQL Injection.This issue affects WPLMS: from n/a through < 1.9.9.5.3.

Remedy

Update the WordPress WPLMS plugin to the latest available version (at least 1.9.9.5.3).
First published (updated )
CVE-2024-56042

VibeThemes VibeBPWordPress VibeBP plugin < 1.9.9.5.1 - SQL Injection vulnerability

Risk 40
Severity
8.5
SQL Injection
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes VibeBP vibebp allows SQL Injection.This issue affects VibeBP: from n/a through < 1.9.9.5.1.

Remedy

Update the WordPress VibeBP plugin to the latest available version (at least 1.9.9.5.1).
First published (updated )
CVE-2024-56041

VibeThemes WPLMSWordPress WPLMS plugin <= 1.9.9 - Unauthenticated Arbitrary File Upload vulnerability

Risk 87
Severity
10
Malicious File Upload
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplmsplugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through <= 1.9.9.

Remedy

Update the WordPress WPLMS plugin to the latest available version (at least 1.9.9.1).
First published (updated )
CVE-2024-56046

VibeThemes WPLMSWordPress WPLMS plugin < 1.9.9.5.3 - Subscriber+ SQL Injection vulnerability

Risk 81
Severity
8.8
SQL Injection
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplmsplugin allows SQL Injection.This issue affects WPLMS: from n/a through < 1.9.9.5.3.

Remedy

Update the WordPress WPLMS plugin to the latest available version (at least 1.9.9.5.3).
First published (updated )
CVE-2024-56047

VibeThemes WPLMSWordPress WPLMS plugin < 1.9.9.5.3 - Instructor+ SQL Injection vulnerability

Risk 81
Severity
8.8
SQL Injection
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplmsplugin allows SQL Injection.This issue affects WPLMS: from n/a through < 1.9.9.5.3.

Remedy

Update the WordPress WPLMS plugin to the latest available version (at least 1.9.9.5.3).
First published (updated )
CVE-2024-56053

VibeThemes WPLMSWordPress WPLMS plugin <= 1.9.9 - Arbitrary Option Update to Privilege Escalation vulnerability

Risk 45
Severity
8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Missing Authorization vulnerability in VibeThemes WPLMS wplmsplugin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPLMS: from n/a through <= 1.9.9.

Remedy

Update the WordPress WPLMS plugin to the latest available version (at least 1.9.9.1).
First published (updated )
CVE-2024-56048

VibeThemes WPLMSWordPress WPLMS plugin < 1.9.9.5.3 - Subscriber+ Arbitrary File Upload vulnerability

Risk 81
Severity
9.9
Malicious File Upload
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplmsplugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through < 1.9.9.5.3.

Remedy

Update the WordPress WPLMS plugin to the latest available version (at least 1.9.9.5.3).
First published (updated )
CVE-2024-56050

VibeThemes WPLMSWordPress WPLMS plugin < 1.9.9.5.2 - Student+ Arbitrary File Upload vulnerability

Risk 81
Severity
9.9
Malicious File Upload
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplmsplugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through < 1.9.9.5.2.

Remedy

Update the WordPress WPLMS plugin to the latest available version (at least 1.9.9.5.2).
First published (updated )
CVE-2024-56052

VibeThemes WPLMSWordPress WPLMS plugin < 1.9.9.5.2 - Instructor+ Arbitrary File Upload vulnerability

Risk 81
Severity
9.1
Malicious File Upload
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplmsplugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through < 1.9.9.5.2.

Remedy

Update the WordPress WPLMS plugin to the latest available version (at least 1.9.9.5.2).
First published (updated )
CVE-2024-56054

VibeThemes WPLMSWordPress WPLMS plugin < 1.9.9.5.2 - Arbitrary File Upload vulnerability

Risk 81
Severity
9.9
Malicious File Upload
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Unrestricted Upload of File with Dangerous Type vulnerability in VibeThemes WPLMS wplmsplugin allows Upload a Web Shell to a Web Server.This issue affects WPLMS: from n/a through < 1.9.9.5.2.

Remedy

Update the WordPress WPLMS plugin to the latest available version (at least 1.9.9.5.2).
First published (updated )
CVE-2024-56057

VibeThemes WPLMSWordPress WPLMS plugin < 1.9.9.5.2 - Subscriber+ Arbitrary File Deletion vulnerability

Risk 43
Severity
8.5
Path Traversal
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H

Path Traversal: '.../...//' vulnerability in VibeThemes WPLMS wplmsplugin allows Path Traversal.This issue affects WPLMS: from n/a through < 1.9.9.5.2.

Remedy

Update the WordPress WPLMS plugin to the latest available version (at least 1.9.9.5.2).
First published (updated )
CVE-2024-56049

VibeThemes WPLMSWordPress WPLMS plugin < 1.9.9.5.2 - Arbitrary Directory Deletion vulnerability

Risk 81
Severity
8.8
Path Traversal
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Path Traversal: '.../...//' vulnerability in VibeThemes WPLMS wplmsplugin allows Path Traversal.This issue affects WPLMS: from n/a through < 1.9.9.5.2.

Remedy

Update the WordPress WPLMS plugin to the latest available version (at least 1.9.9.5.2).
First published (updated )
CVE-2024-56055

VibeThemes WPLMSWordPress WPLMS plugin < 1.9.9.5 - Student+ Remote Code Execution (RCE) vulnerability

Risk 81
Severity
8.8
Code Injection
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Improper Control of Generation of Code ('Code Injection') vulnerability in VibeThemes WPLMS wplmsplugin allows Code Injection.This issue affects WPLMS: from n/a through < 1.9.9.5.

Remedy

Update the WordPress WPLMS plugin to the latest available version (at least 1.9.9.5).
First published (updated )
CVE-2024-56051

WPLMS Learning Management System for WordPressWPLMS Learning Management System for WordPress <= 4.962 - Unauthenticated Arbitrary File Read and Deletion

Risk 86
Severity
9.8
Path Traversal
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The WPLMS Learning Management System for WordPress, WordPress LMS theme for WordPress is vulnerable to arbitrary file read and deletion due to insufficient file path validation and permissions checks in the readfile and unlink functions in all versions up to, and including, 4.962. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The theme is vulnerable even when it is not activated.

First published (updated )
CVE-2024-10470

VibeThemes Vslider WordpressWordPress vSlider Multi Image Slider for WordPress Plugin <= 4.1.2 is vulnerable to Cross Site Request Forgery (CSRF)

Risk 77
Severity
8.8
CSRF
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Cross-Site Request Forgery (CSRF) vulnerability in Mr.Vibe vSlider Multi Image Slider for WordPress plugin <= 4.1.2 versions.

First published (updated )
CVE-2023-22672

WPLMS Learning Management System for WordPressWordPress WPLMS Theme < 4.900 is vulnerable to Cross Site Request Forgery (CSRF)

Risk 77
Severity
8.8
CSRF
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Cross-Site Request Forgery (CSRF) vulnerability in VibeThemes WPLMS theme <= 4.900 versions.

First published (updated )
CVE-2023-36690

VibeThemes Bp Social Connect WordpressBP Social Connect <= 1.5 - Authentication Bypass

Risk 86
Severity
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The BP Social Connect plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.5. This is due to insufficient verification on the user being supplied during a Facebook login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.

First published (updated )
CVE-2023-2704

Vslider Multi Image Slider Project Vslider Multi Image Slider WordpressWordPress vSlider Multi Image Slider for WordPress Plugin <= 4.1.2 is vulnerable to Cross Site Scripting (XSS)

Risk 40
Severity
5.9
XSS
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Auth. Stored Cross-Site Scripting (XSS) vulnerability in Mr.Vibe vSlider Multi Image Slider for WordPress plugin <= 4.1.2 versions.

First published (updated )
CVE-2023-25797

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203