WPLMS Plugin

WPLMS Plugin has 6 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; 3 are fixed and 3 remain unpatched as of October 2026. Their average CVSS score is 7.0, and the most serious one scores 9.1 out of 10. Severity breakdown: 1 critical and 2 high. 2025 was the busiest year with 3 disclosures.

The most common weakness is Cross-Site Scripting, behind 2 of the records (33%). Other recurring categories include SQL Injection, Missing Authorization.

3 of the records (50%) have a vendor fix, while 3 remain unpatched. The oldest unresolved one dates back to 2025.

2 independent researchers contributed these findings, most of them (4) reported by Rafie Muhammad.

Strategic Overview

Avg CVSSMedium

7.0/ 10

Patch Coverage50%

Open

Fixed

Get automatic notifications for all WPLMS Plugin vulnerabilities before they are exploited.

Most severe open issueCVSS 9.1CVE-2025-69097

WPLMS <= 1.9.9.5.4 - Unauthenticated Arbitrary File Deletion

Read the full analysis

Vulnerability Records

6 records


2026-10-02 00:00	WPLMS Plugin < 1.9.9.8.2 - Unauthenticated SQL Injection WPLMS Plugin < 1.9.9.8.2	`CVE-2026-96327`	7.5 High	Rafie Muhammad	Yes
2026-01-13 00:00	WPLMS <= 1.9.9.5.4 - Unauthenticated Arbitrary File Deletion WPLMS Plugin <= 1.9.9.5.4	`CVE-2025-69097`	9.1 Critical	João Pedro Soares de Alcântara	No
2025-10-27 00:00	WPLMS <= 1.9.9.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting WPLMS Plugin <= 1.9.9.5.4	`CVE-2025-63035`	6.4 Medium	João Pedro Soares de Alcântara	No
2025-09-14 00:00	WPLMS <= 1.9.9.7 - Missing Authorization WPLMS Plugin <= 1.9.9.7	`CVE-2025-49925`	5.3 Medium	Rafie Muhammad	Yes
2025-09-14 00:00	WPLMS <= 1.9.9.8 - Reflected Cross-Site Scripting WPLMS Plugin <= 1.9.9.8	`CVE-2025-53420`	6.1 Medium	Rafie Muhammad	No
2024-12-17 00:00	WPLMS < 1.9.9.5.3 - Unauthenticated SQL Injection WPLMS Plugin < 1.9.9.5.3	`CVE-2024-56042`	7.5 High	Rafie Muhammad	Yes

Showing 1–6 of 6 reports