Vulnerabilidades em ThimPress

120 resultados
Análise Vexday

Os produtos ThimPress acumulam 57 CVEs catalogadas, das quais 7 são classificadas como críticas e 2 contam com prova de conceito pública disponível, o que representa um vetor concreto de exploração para defensores monitorarem. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com nenhum registro confirmado de uso malicioso ativo no momento, embora isso não elimine o risco operacional. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), padrão que tende a ser subestimado, mas que pode ser encadeado em ataques mais complexos. A CVE mais perigosa no contexto atual é CVE-2022-47615, com escore EPSS de 0,0506, e o surgimento de 3 novas vulnerabilidades nos últimos 90 dias indica uma superfície de ataque ainda em expansão que merece acompanhamento contínuo.

CVE-2025-48336CRITICALWordPress Course Builder < 3.6.6 - PHP Object Injection VulnerabilityEPSS 0.5%CVE-2025-11372MEDIUMLearnPress – WordPress LMS Plugin <= 4.2.9.3 - Missing Authorization to Unauthenticated Database Table ManipulationEPSS 0.5%CVE-2026-7566MEDIUMLearnPress – Backup & Migration Tool <= 4.1.4 - Authenticated (Administrator+) PHP Object Injection via WXR XML File UploadEPSS 0.4%CVE-2026-11392MEDIUMWP Hotel Booking <= 2.3.1 - Reflected Cross-Site Scripting via 'check_in_date' and 'check_out_date' ParametersEPSS 0.4%CVE-2025-64195HIGHWordPress Eduma theme <= 5.7.6 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2025-67526HIGHWordPress Sailing theme < 4.4.6 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2023-36515HIGHWordPress LearnPress plugin <= 4.2.3 - Unauthenticated Broken Access Control vulnerabilityEPSS 0.4%CVE-2025-60200HIGHWordPress LearnPress Export Import plugin <= 4.1.2 - Local File Inclusion vulnerabilityEPSS 0.4%CVE-2026-7648MEDIUMLearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.5 - Authenticated (Subscriber+) Payment Bypass to Free Course Enrollment via 'quantity' ParameterEPSS 0.4%CVE-2024-1463MEDIUMLearnPress <= 4.2.6.3 - Authenticated(LP Instructor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-6099MEDIUMLearnPress – WordPress LMS Plugin <= 4.2.6.8.1 - Unauthenticated Bypass to User RegistrationEPSS 0.4%CVE-2024-34415MEDIUMWordPress Thim Elementor Kit plugin <= 1.1.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2025-28982CRITICALWordPress WP Pipes plugin <= 1.4.3 - SQL Injection VulnerabilityEPSS 0.4%CVE-2025-13725MEDIUMGutenberg Thim Blocks <= 1.0.1 - Authenticated (Contributor+) Arbitrary File Read via 'iconSVG' ParameterEPSS 0.4%CVE-2026-4650MEDIUMFundPress <= 2.0.8 - Missing Authorization to Unauthenticated Arbitrary Donation Status Modification via donate_action_status AJAX HandlerEPSS 0.4%CVE-2020-36757MEDIUMWP Hotel Booking <= 1.10.1 - Cross-Site Request Forgery BypassEPSS 0.4%CVE-2021-36852MEDIUMWordPress WP Hotel Booking plugin <= 1.10.5 - Cross-Site Request Forgery (CSRF) vulnerabilityEPSS 0.4%CVE-2024-39642MEDIUMWordPress LearnPress plugin <= 4.2.6.8.2 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.4%CVE-2024-1289MEDIUMLearnPress <= 4.2.6.3 - Insecure Direct Object ReferenceEPSS 0.4%CVE-2023-30487HIGHWordPress LearnPress Export Import Plugin <= 4.0.2 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%