Vulnerabilidades em ThimPress

120 resultados
Análise Vexday

Os produtos ThimPress acumulam 57 CVEs catalogadas, das quais 7 são classificadas como críticas e 2 contam com prova de conceito pública disponível, o que representa um vetor concreto de exploração para defensores monitorarem. A taxa de exploração ativa está abaixo da média geral do catálogo KEV, com nenhum registro confirmado de uso malicioso ativo no momento, embora isso não elimine o risco operacional. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), padrão que tende a ser subestimado, mas que pode ser encadeado em ataques mais complexos. A CVE mais perigosa no contexto atual é CVE-2022-47615, com escore EPSS de 0,0506, e o surgimento de 3 novas vulnerabilidades nos últimos 90 dias indica uma superfície de ataque ainda em expansão que merece acompanhamento contínuo.

CVE-2025-14798MEDIUMLearnPress – WordPress LMS Plugin <= 4.3.2.4 - Missing Authorization to Unauthenticated Sensitive User Information Disclosure via REST APIEPSS 0.3%CVE-2025-57987MEDIUMWordPress WP Events Manager Plugin <= 2.2.1 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2025-22739MEDIUMWordPress LearnPress plugin <= 4.2.7.5 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-2115HIGHLearnPress – WordPress LMS Plugin <= 4.0.0 - Cross-Site Request Forgery to Privilege EscalationEPSS 0.3%CVE-2026-25002HIGHWordPress LearnPress – Sepay Payment plugin <= 4.0.0 - Broken Authentication vulnerabilityEPSS 0.3%CVE-2025-66054HIGHWordPress LearnPress plugin <= 4.2.9.4 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-13964MEDIUMLearnPress – WordPress LMS Plugin <= 4.3.2 - Missing Authentication to Unauthenticated Course ModificationEPSS 0.3%CVE-2025-22312MEDIUMWordPress Thim Elementor Kit plugin <= 1.2.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-39460MEDIUMWordPress Eduma theme <= 5.6.4 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-1870MEDIUMThim Kit for Elementor <= 1.3.7 - Missing Authorization to Unauthenticated Private Course DisclosureEPSS 0.3%CVE-2026-3225MEDIUMLearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Answer DeletionEPSS 0.3%CVE-2025-24740MEDIUMWordPress Learnpress plugin <= 4.2.7.1 - Open Redirection vulnerabilityEPSS 0.3%CVE-2026-11901MEDIUMWP Hotel Booking <= 2.3.1 - Unauthenticated Insufficient Verification of Data Authenticity to Payment Bypass via PayPal IPN HandlerEPSS 0.3%CVE-2025-63013MEDIUMWordPress WP Hotel Booking plugin <= 2.2.7 - Sensitive Data Exposure vulnerabilityEPSS 0.3%CVE-2025-67573MEDIUMWordPress Sailing theme < 4.4.6 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-49992HIGHWordPress LearnPress Export Import plugin <= 4.0.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-1787MEDIUMLearnPress Export Import <= 4.1.0 - Missing Authentication to Unauthenticated Migrated Course DeletionEPSS 0.2%CVE-2025-28977HIGHWordPress WP Pipes Plugin <= 1.4.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-14387MEDIUMLearnPress – WordPress LMS Plugin <= 4.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via get_profile_socialEPSS 0.2%CVE-2026-75982MEDIUMLearnPress <= 4.4.4 - Missing Authorization to Authenticated (Editor+) Limited Option Update via 'field_name' ParameterEPSS 0.2%