Vulnerabilidades em thimpress

120 resultados
Análise Vexday

Com 50 CVEs catalogadas e 6 de severidade crítica, o histórico de vulnerabilidades da ThimPress indica uma superfície de ataque que merece monitoramento contínuo, especialmente considerando que 7 novas ocorrências surgiram nos últimos 90 dias. A falha mais comum é CWE-862 (ausência de verificação de autorização), padrão que frequentemente permite que usuários não autenticados ou de baixo privilégio acessem funcionalidades restritas. A CVE mais perigosa ativa no momento, CVE-2024-8522, apresenta score EPSS de 0,6136, sinalizando probabilidade elevada de exploração em ambiente real; embora nenhuma CVE do vendor conste no catálogo CISA KEV — resultado abaixo da média geral —, a presença de 3 vulnerabilidades com PoC pública mantém o risco concreto para instalações desatualizadas.

CVE-2024-9609MEDIUMLearnPress Export Import – WordPress extension for LearnPress <= 4.0.4 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2024-12283MEDIUMWP Pipes <= 1.4.1 - Reflected Cross-Site Scripting via x1 ParameterEPSS 0.4%CVE-2024-13447MEDIUMWP Hotel Booking <= 2.1.6 - Missing Authorization to Authenticated (Subscriber+) User Email RetrievalEPSS 0.4%CVE-2024-4329MEDIUMThim Elementor Kit <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via id ParameterEPSS 0.4%CVE-2026-77823MEDIUMLearnPress <= 4.4.4 - Authenticated (Administrator+) SQL Injection via 'orderby' ParameterEPSS 0.4%CVE-2025-24725MEDIUMWordPress Thim Elementor Kit Plugin <= 1.2.8 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2023-6223MEDIUMLearnPress <= 4.2.5.7 - Insecure Direct Object Reference to Information DisclosureEPSS 0.3%CVE-2024-4277MEDIUMLearnPress – WordPress LMS Plugin <= 4.2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via layout_html ParameterEPSS 0.3%CVE-2026-27065CRITICALWordPress BuilderPress plugin <= 2.0.1 - Local File Inclusion vulnerabilityEPSS 0.3%CVE-2026-12732MEDIUMLearnPress <= 4.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class_wrapper_form' Shortcode AttributeEPSS 0.3%CVE-2025-14802MEDIUMLearnPress – WordPress LMS Plugin <= 4.3.2.2 - Insecure Direct Object Reference to Authenticated (Instructor+) Teacher Material DeletionEPSS 0.3%CVE-2024-3560MEDIUMLearnPress – WordPress LMS Plugin <= 4.2.6.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-12370MEDIUMWP Hotel Booking <= 2.1.5 - Missing AuthorizationEPSS 0.3%CVE-2026-4333MEDIUMLearnPress <= 4.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'skin' Shortcode AttributeEPSS 0.3%CVE-2024-13599MEDIUMLearnPress – WordPress LMS Plugin <= 4.2.7.5 - Authenticated (LP Instructor+) Stored Cross-Site Scripting via Lesson NameEPSS 0.3%CVE-2025-14075MEDIUMWP Hotel Booking <= 2.2.7 - Unauthenticated Sensitive Information Exposure via 'email' ParameterEPSS 0.3%CVE-2024-4971MEDIUMLearnPress – WordPress LMS Plugin <= 4.2.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id ParameterEPSS 0.3%CVE-2025-53345HIGHWordPress Thim Core plugin <= 2.3.3 - Arbitrary Plugin Installation vulnerabilityEPSS 0.3%CVE-2024-35697HIGHWordPress Eduma theme <= 5.4.7 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-66458CRITICALWordPress RealPress plugin <= 1.1.2 - SQL Injection vulnerabilityEPSS 0.3%