Known vulnerabilities in School Management System – WPSchoolPress

Comprehensive school management plugin with attendance, classes, timetables, exams, grading, notifications, events and academic calendar.

14Reported vulnerabilities

8.8Highest CVSS score

2.2.48Latest version

1,000+Active installs

What to do now

Update School Management System – WPSchoolPress to 2.2.24 or later. 13 of these have a fixed version available. Updating resolves them.

Plugin last updated: August 7, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2021-24575	High 8.8	1.4%	Before 2.1.10	`2.1.10`	November 8, 2021
CVE-2023-4776	High 8.8	0.7%	Before 2.2.5	`2.2.5`	October 16, 2023
CVE-2021-24664	Medium 4.8	2.4%	Before 2.1.17	`2.1.17`	November 8, 2021
CVE-2024-9637	High 8.8	0.5%	Before 2.2.11	`2.2.11`	October 26, 2024
WF-58a83ec8-e294-4fb6-9f1a-19562b2e499d	High 7.1	—	Before 2.1.10	`2.1.10`	October 11, 2021
CVE-2025-1670	Medium 6.5	0.4%	2.2.16 and earlier	`2.2.17`	March 15, 2025
CVE-2025-1669	Medium 6.5	0.4%	2.2.16 and earlier	`2.2.18`	March 15, 2025
CVE-2024-12332	Medium 6.5	0.4%	2.2.14 and earlier	`2.2.15`	January 7, 2025
WF-1a2fb050-1a7c-45cc-86c7-02331d47f780	Medium 6.3	—	Before 2.2.5	`2.2.5`	September 18, 2023
CVE-2025-1668	Medium 5.4	0.3%	2.2.16 and earlier	`2.2.17`	March 15, 2025
CVE-2023-37887	Medium 5.4	0.6%	2.2.3 and earlier	`2.2.4`	July 11, 2023
CVE-2025-11981	Medium 4.9	0.3%	0 to 2.2.23 (inclusive)	`2.2.24`	November 14, 2025
CVE-2026-39631	Medium 4.3	0.3%	2.2.36 and earlier	—	February 13, 2026
CVE-2025-1667	Medium 4.3	0.4%	2.2.16 and earlier	`2.2.17`	March 15, 2025

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.