WPLMS vulnerabilities

Blind SQL Injection vulnerability in the WPLMS plugin. Affects versions from n/a through 4.973.

The WPLMS plugin (versions before 1.9.9.8.2) contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This allows an attacker to perform a Blind SQL Injection attack.

Unauthenticated Cross Site Scripting (XSS) in WPLMS versions up to 4.972.

DOM-Based XSS vulnerability in WPLMS plugin by VibeThemes. Improper input neutralization during web page generation allows client-side script injection.

Reflected XSS vulnerability in VibeThemes WPLMS plugin (wplms_plugin) up to version 1.9.9.8 due to improper input neutralization during web page generation.

The WPLMS plugin for WordPress (versions up to and including 4.970) contains a Missing Authorization vulnerability allowing exploitation of incorrectly configured access control levels. An unauthorized user can perform operations reserved for higher roles.