4.3/5
G2 rating
78 verified reviews
Report
Should I Use Totara Learning?
Enterprise learning management system for organizations that need flexibility, compliance, and scalable workforce development.
Depends
DependsBuy if you're a mid-size or large organization with compliance needs and staff to administer a customizable LMS.
Enterprise LMS with deep compliance customization — fits big orgs with admins; overkill, quote-only pricing for small teams.
Confidence: Medium
1,800+
Customers
incl. USDA, Samsung, NHS
3.8/5
Glassdoor employee rating
16 reviews
27001:2022
ISO certification
Certified Dec 2025
Value for money
3
Open-source roots cut cost, but pricing hidden behind partner quotes
Feature depth
5
Deep compliance, certifications, LXP; repeatedly praised for flexibility
Security posture
2
ISO 27001 certified, but three 2026 CVEs disclosed
Pros
Cons
Gotchas
- highVersions 19.1.5 and earlier carry known CVEs; confirm your deployment is fully patched before signing.
- mediumPricing is quote-only via partners; expect negotiation and variable costs.⁹
- mediumDespite open-source heritage, a commercial license and subscription agreement governs use — read terms carefully.
- mediumFedRAMP appears in marketing analysis, not confirmed authorization — verify before federal procurement.
Best for
- Compliance-heavy enterprises
- Government and healthcare orgs
- Global workforces needing customization
- Teams with dedicated L&D admins
Not for
- Small teams wanting a simple course library
- Startups without dedicated L&D staff
- Buyers needing transparent self-serve pricing
- Non-technical buyers without a delivery partner
Pricing
Enterprise (via partners)
Quote only
- Partner-led licensing and implementation
- LMS + LXP + Engage platform
- Compliance and certification modules
Security
ISO 27001:2022 certified, but three CVEs disclosed in 2026 affecting v19.1.5 and earlier.
- CVE-2026-31281: HTML injection in in-app messaging (CVSS 8)Versions 19.1.5 and earlier accept user-supplied HTML in the in-app messaging client, allowing malicious message injection.⁵
- CVE-2026-31282: Incorrect access control on login pageFlawed access control on the login page permits attacker access.⁶
- CVE-2026-31283: No rate limiting on forgot-password APIForgot-password API in releases 19.1.5 and earlier lacks rate limiting, enabling abuse.⁷
What users say
Reviewers and analysts consistently praise Totara's flexibility, while some employee reviews describe a troubled internal culture.
“Great people * Great work environment and culture. Several colleagues have left in the past, then retur”
“Absolutely disgusting and unprofessional work environment.”
“Totara Learn and Engage are perfect for the organization that is looking to have maximum flexibility on how learning is delivered.”
Alternatives
Compare Totara Learning with each alternative.
TalentLMS
Simpler, self-serve pricing for small-to-mid teams
Totara Learning vs TalentLMSDocebo
Comparable enterprise depth with easier evaluation
Totara Learning vs DoceboMoodle
Free open-source option for DIY-minded teams
Totara Learning vs MoodleMemberspot
E-learning platform for coaches and trainers
Full analysis
Based on 11+ public sources across reviews, security databases, official pages, and market data. No public pricing found; confidence medium.
Sources
review
- Totara Learning Solutions Reviews — Glassdoorglassdoor.comreview
- Totara LMS Review and Overview — Talented Learningtalentedlearning.comreview
review
- CVE-2026-31281 — XSS vulnerabilityapp.opencve.iosecurity
- CVE-2026-31282 — access control flawapp.opencve.iosecurity
- CVE-2026-31283 — forgot password API flawapp.opencve.iosecurity
- Totara ISO/IEC 27001:2022 certificationtotara.comsecurity
- Totara Learn on UK G-Cloud Digital Marketplace (Titus Learning)applytosupply.digitalmarketplace.service.gov.ukofficial
news
Rate this review
Anonymous. You can change your vote.
Loading votes…
Ask a follow-up
Ask if a use case fits. Answers stay inside this report and its sources.