Known vulnerabilities in WPComplete

A WordPress plugin that helps your students keep track of their progress through your course.

7Reported vulnerabilities

7.2Highest CVSS score

2.9.5.6Latest version

1,000+Active installs

What to do now

Update WPComplete to 2.9.5.7 or later. 7 of these have a fixed version available. Updating resolves them.

Plugin last updated: June 8, 2026 / Tested up to WordPress: 6.8.8 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2026-66599	High 7.2	0.1%	2.9.5.6 and earlier	`2.9.5.7`	August 20, 2026
CVE-2026-42750	Medium 6.4	0.1%	2.9.5.4 and earlier	`2.9.5.5`	May 29, 2026
CVE-2025-58974	Medium 6.4	0.2%	2.9.5.2 and earlier	`2.9.5.3`	September 22, 2025
CVE-2025-50046	Medium 6.4	0.2%	2.9.5 and earlier	`2.9.5.1`	June 19, 2025
CVE-2022-45825	Medium 6.1	0.5%	Before 2.9.5	`2.9.5`	January 27, 2023
CVE-2025-49906	Medium 5.3	0.3%	2.9.5.3 and earlier	`2.9.5.4`	October 24, 2025
CVE-2026-57661	Medium 4.3	0.3%	2.9.5.5 and earlier	`2.9.5.6`	June 26, 2026

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.