Vulnerabilities in thimpress
137 resultsCVE-2024-31241HIGHWordPress LearnPress Export Import plugin <= 4.0.3 - Auth. SQL Injection vulnerabilityEPSS 0.5%CVE-2025-28982CRITICALWordPress WP Pipes plugin <= 1.4.3 - SQL Injection VulnerabilityEPSS 0.5%CVE-2025-67526HIGHWordPress Sailing theme < 4.4.6 - Local File Inclusion vulnerabilityEPSS 0.5%CVE-2025-64195HIGHWordPress Eduma theme <= 5.7.6 - Local File Inclusion vulnerabilityEPSS 0.5%CVE-2026-11988MEDIUMLearnPress <= 4.3.9.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'userId' ParameterEPSS 0.5%CVE-2025-60200HIGHWordPress LearnPress Export Import plugin <= 4.1.2 - Local File Inclusion vulnerabilityEPSS 0.5%CVE-2025-11372MEDIUMLearnPress – WordPress LMS Plugin <= 4.2.9.3 - Missing Authorization to Unauthenticated Database Table ManipulationEPSS 0.5%CVE-2026-7566MEDIUMLearnPress – Backup & Migration Tool <= 4.1.4 - Authenticated (Administrator+) PHP Object Injection via WXR XML File UploadEPSS 0.4%CVE-2026-11392MEDIUMWP Hotel Booking <= 2.3.1 - Reflected Cross-Site Scripting via 'check_in_date' and 'check_out_date' ParametersEPSS 0.4%CVE-2026-77823MEDIUMLearnPress <= 4.4.4 - Authenticated (Administrator+) SQL Injection via 'orderby' ParameterEPSS 0.4%CVE-2023-36515HIGHWordPress LearnPress plugin <= 4.2.3 - Unauthenticated Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-7648MEDIUMLearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.5 - Authenticated (Subscriber+) Payment Bypass to Free Course Enrollment via 'quantity' ParameterEPSS 0.4%CVE-2024-1463MEDIUMLearnPress <= 4.2.6.3 - Authenticated(LP Instructor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2025-13725MEDIUMGutenberg Thim Blocks <= 1.0.1 - Authenticated (Contributor+) Arbitrary File Read via 'iconSVG' ParameterEPSS 0.4%CVE-2024-6099MEDIUMLearnPress – WordPress LMS Plugin <= 4.2.6.8.1 - Unauthenticated Bypass to User RegistrationEPSS 0.4%CVE-2024-34415MEDIUMWordPress Thim Elementor Kit plugin <= 1.1.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-4650MEDIUMFundPress <= 2.0.8 - Missing Authorization to Unauthenticated Arbitrary Donation Status Modification via donate_action_status AJAX HandlerEPSS 0.4%CVE-2024-9609MEDIUMLearnPress Export Import – WordPress extension for LearnPress <= 4.0.4 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2026-66458CRITICALWordPress RealPress plugin <= 1.1.2 - SQL Injection vulnerabilityEPSS 0.4%CVE-2021-36852MEDIUMWordPress WP Hotel Booking plugin <= 1.10.5 - Cross-Site Request Forgery (CSRF) vulnerabilityEPSS 0.4%