Vulnerabilidades em thimpress

120 resultados
Análise Vexday

Com 50 CVEs catalogadas e 6 de severidade crítica, o histórico de vulnerabilidades da ThimPress indica uma superfície de ataque que merece monitoramento contínuo, especialmente considerando que 7 novas ocorrências surgiram nos últimos 90 dias. A falha mais comum é CWE-862 (ausência de verificação de autorização), padrão que frequentemente permite que usuários não autenticados ou de baixo privilégio acessem funcionalidades restritas. A CVE mais perigosa ativa no momento, CVE-2024-8522, apresenta score EPSS de 0,6136, sinalizando probabilidade elevada de exploração em ambiente real; embora nenhuma CVE do vendor conste no catálogo CISA KEV — resultado abaixo da média geral —, a presença de 3 vulnerabilidades com PoC pública mantém o risco concreto para instalações desatualizadas.

CVE-2024-4444MEDIUMLearnPress – WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Bypass to User RegistrationEPSS 0.7%CVE-2026-7565MEDIUMLearnPress <= 4.1.4 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'import-user-file' ParameterEPSS 0.7%CVE-2026-15094MEDIUMWP Hotel Booking <= 2.3.2 - Reflected Cross-Site Scripting via 'check_in_date' ParameterEPSS 0.7%CVE-2026-13765HIGHLearnPress <= 4.4.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure via /lp/v1/users/check-answer and /start-quiz REST EndpointsEPSS 0.7%CVE-2025-39470HIGHWordPress Ivy School theme <= 1.6.0 - Local File Inclusion VulnerabilityEPSS 0.7%CVE-2022-45355HIGHWordPress WP Pipes Plugin <= 1.33 is vulnerable to SQL Injection (SQLi)EPSS 0.6%CVE-2024-7548HIGHLearnPress – WordPress LMS Plugin <= 4.2.6.9.3 - Authenticated (Contributor+) SQL Injection via order ParameterEPSS 0.6%CVE-2024-6088MEDIUMLearnPress – WordPress LMS Plugin <= 4.2.6.8.1 - Missing Authorization to Unauthenticated User Registration BypassEPSS 0.6%CVE-2024-32588HIGHWordPress LearnPress Export Import plugin <= 4.0.3 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.5%CVE-2026-8502MEDIUMLearnPress <= 4.3.6 - Unauthenticated Sensitive Information Exposure via 'c_status' and 'return_type' ParametersEPSS 0.5%CVE-2024-51582HIGHWordPress WP Hotel Booking plugin <= 2.2.9 - Local File Inclusion vulnerabilityEPSS 0.5%CVE-2024-30508MEDIUMWordPress WP Hotel Booking plugin <= 2.0.9.2 - Broken Access Control vulnerabilityEPSS 0.5%CVE-2023-36516HIGHWordPress LearnPress plugin <= 4.2.3 - Authenticated Broken Access Control vulnerabilityEPSS 0.5%CVE-2025-60227HIGHWordPress WP Pipes plugin <= 1.4.3 - Arbitrary File Deletion vulnerabilityEPSS 0.5%CVE-2024-7717HIGHWP Events Manager <= 2.1.11 - Authenticated (Subscriber+) Time-Based SQL InjectionEPSS 0.5%CVE-2025-24601CRITICALWordPress FundPress plugin <= 2.0.6 - PHP Object Injection vulnerabilityEPSS 0.5%CVE-2024-31241HIGHWordPress LearnPress Export Import plugin <= 4.0.3 - Auth. SQL Injection vulnerabilityEPSS 0.5%CVE-2026-11988MEDIUMLearnPress <= 4.3.9.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'userId' ParameterEPSS 0.5%CVE-2025-28979HIGHWordPress WP Pipes <= 1.4.3 - Local File Inclusion VulnerabilityEPSS 0.5%CVE-2025-48267HIGHWordPress WP Pipes plugin <= 1.4.2 - Arbitrary File Deletion VulnerabilityEPSS 0.5%