# cve.now: Vibethemes

The newest entries naming Vibethemes as an affected vendor (up to 200), of 31 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-95607](https://cve.now/CVE-2026-95607.md): WordPress WPLMS theme \<= 4.973 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2026-96327](https://cve.now/CVE-2026-96327.md): WordPress WPLMS plugin \< 1.9.9.8.2 - SQL Injection vulnerability (CVSS 9.3)
- [CVE-2026-39722](https://cve.now/CVE-2026-39722.md): WordPress WPLMS theme \<= 4.972 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-69097](https://cve.now/CVE-2025-69097.md): WordPress WPLMS plugin \<= 1.9.9.5.4 - Arbitrary File Deletion vulnerability (CVSS 8.6)
- [CVE-2025-63035](https://cve.now/CVE-2025-63035.md): WordPress WPLMS plugin \<= 1.9.9.5.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-53420](https://cve.now/CVE-2025-53420.md): WordPress WPLMS plugin \<= 1.9.9.8 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-49925](https://cve.now/CVE-2025-49925.md): WordPress WPLMS plugin \<= 1.9.9.7 - Broken Access Control vulnerability (CVSS 7.5)
- [CVE-2025-58668](https://cve.now/CVE-2025-58668.md): WordPress WPLMS theme \<= 4.970 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2015-10139](https://cve.now/CVE-2015-10139.md): WPLMS Learning Management System for WordPress, WordPress LMS \<= 1.8.4.1 - Privilege Escalation (CVSS 8.8)
- [CVE-2025-32493](https://cve.now/CVE-2025-32493.md): WordPress BP Social Connect plugin \<= 1.6.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9)
- [CVE-2024-56045](https://cve.now/CVE-2024-56045.md): WordPress WPLMS plugin \< 1.9.9.5 - Unauthenticated Arbitrary Directory Deletion vulnerability (CVSS 9.3)
- [CVE-2024-56044](https://cve.now/CVE-2024-56044.md): WordPress WPLMS plugin \<= 1.9.9 - Unauthenticated Arbitrary User Token Generation vulnerability (CVSS 9.8)
- [CVE-2024-56043](https://cve.now/CVE-2024-56043.md): WordPress WPLMS plugin \<= 1.9.9 - Unauthenticated Privilege Escalation vulnerability (CVSS 9.8)
- [CVE-2024-56040](https://cve.now/CVE-2024-56040.md): WordPress VibeBP plugin \<= 1.9.9.4.1 - Unauthenticated Privilege Escalation vulnerability (CVSS 9.8)
- [CVE-2024-56042](https://cve.now/CVE-2024-56042.md): WordPress WPLMS plugin \< 1.9.9.5.3 - Unauthenticated SQL Injection vulnerability (CVSS 9.3)
- [CVE-2024-56041](https://cve.now/CVE-2024-56041.md): WordPress VibeBP plugin \< 1.9.9.5.1 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2024-56039](https://cve.now/CVE-2024-56039.md): WordPress VibeBP plugin \< 1.9.9.7.7 - Unauthenticated SQL Injection vulnerability (CVSS 9.3)
- [CVE-2024-56046](https://cve.now/CVE-2024-56046.md): WordPress WPLMS plugin \<= 1.9.9 - Unauthenticated Arbitrary File Upload vulnerability (CVSS 10.0)
- [CVE-2024-56047](https://cve.now/CVE-2024-56047.md): WordPress WPLMS plugin \< 1.9.9.5.3 - Subscriber+ SQL Injection vulnerability (CVSS 8.5)
- [CVE-2024-56053](https://cve.now/CVE-2024-56053.md): WordPress WPLMS plugin \< 1.9.9.5.3 - Instructor+ SQL Injection vulnerability (CVSS 7.6)
- [CVE-2024-56048](https://cve.now/CVE-2024-56048.md): WordPress WPLMS plugin \<= 1.9.9 - Arbitrary Option Update to Privilege Escalation vulnerability (CVSS 8.8)
- [CVE-2024-56050](https://cve.now/CVE-2024-56050.md): WordPress WPLMS plugin \< 1.9.9.5.3 - Subscriber+ Arbitrary File Upload vulnerability (CVSS 9.9)
- [CVE-2024-56052](https://cve.now/CVE-2024-56052.md): WordPress WPLMS plugin \< 1.9.9.5.2 - Student+ Arbitrary File Upload vulnerability (CVSS 9.9)
- [CVE-2024-56054](https://cve.now/CVE-2024-56054.md): WordPress WPLMS plugin \< 1.9.9.5.2 - Instructor+ Arbitrary File Upload vulnerability (CVSS 9.1)
- [CVE-2024-56057](https://cve.now/CVE-2024-56057.md): WordPress WPLMS plugin \< 1.9.9.5.2 - Arbitrary File Upload vulnerability (CVSS 9.9)
- [CVE-2024-56049](https://cve.now/CVE-2024-56049.md): WordPress WPLMS plugin \< 1.9.9.5.2 - Subscriber+ Arbitrary File Deletion vulnerability (CVSS 8.5)
- [CVE-2024-56055](https://cve.now/CVE-2024-56055.md): WordPress WPLMS plugin \< 1.9.9.5.2 - Arbitrary Directory Deletion vulnerability (CVSS 8.5)
- [CVE-2024-56051](https://cve.now/CVE-2024-56051.md): WordPress WPLMS plugin \< 1.9.9.5 - Student+ Remote Code Execution (RCE) vulnerability (CVSS 8.5)
- [CVE-2024-10470](https://cve.now/CVE-2024-10470.md): WPLMS Learning Management System for WordPress \<= 4.962 - Unauthenticated Arbitrary File Read and Deletion (CVSS 9.8)
- [CVE-2023-36690](https://cve.now/CVE-2023-36690.md): WordPress WPLMS Theme \< 4.900 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 8.1)
- [CVE-2023-2704](https://cve.now/CVE-2023-2704.md): BP Social Connect \<= 1.5 - Authentication Bypass (CVSS 9.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/vibethemes
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.