Vulnerabilidades em thimpress

137 resultados
Análise Vexday

Com 50 CVEs catalogadas e 6 de severidade crítica, o histórico de vulnerabilidades da ThimPress indica uma superfície de ataque que merece monitoramento contínuo, especialmente considerando que 7 novas ocorrências surgiram nos últimos 90 dias. A falha mais comum é CWE-862 (ausência de verificação de autorização), padrão que frequentemente permite que usuários não autenticados ou de baixo privilégio acessem funcionalidades restritas. A CVE mais perigosa ativa no momento, CVE-2024-8522, apresenta score EPSS de 0,6136, sinalizando probabilidade elevada de exploração em ambiente real; embora nenhuma CVE do vendor conste no catálogo CISA KEV — resultado abaixo da média geral —, a presença de 3 vulnerabilidades com PoC pública mantém o risco concreto para instalações desatualizadas.

CVE-2026-115599HIGHWordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-13599MEDIUMLearnPress – WordPress LMS Plugin <= 4.2.7.5 - Authenticated (LP Instructor+) Stored Cross-Site Scripting via Lesson NameEPSS 0.3%CVE-2025-14075MEDIUMWP Hotel Booking <= 2.2.7 - Unauthenticated Sensitive Information Exposure via 'email' ParameterEPSS 0.3%CVE-2026-82023MEDIUMLearnPress WordPress Plugin < 4.4.6 Broken Object-Level Authorization via Quiz Answer InsertEPSS 0.3%CVE-2024-4971MEDIUMLearnPress – WordPress LMS Plugin <= 4.2.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id ParameterEPSS 0.3%CVE-2024-35697HIGHWordPress Eduma theme <= 5.4.7 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-14798MEDIUMLearnPress – WordPress LMS Plugin <= 4.3.2.4 - Missing Authorization to Unauthenticated Sensitive User Information Disclosure via REST APIEPSS 0.3%CVE-2026-113353MEDIUMLearnPress before 4.4.10 Missing Authorization via Legacy Editor AJAX HandlersEPSS 0.3%CVE-2025-22739MEDIUMWordPress LearnPress plugin <= 4.2.7.5 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-109208HIGHLearnPress <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' ParametersEPSS 0.3%CVE-2026-25002HIGHWordPress LearnPress – Sepay Payment plugin <= 4.0.0 - Broken Authentication vulnerabilityEPSS 0.3%CVE-2025-57987MEDIUMWordPress WP Events Manager Plugin <= 2.2.1 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2025-22312MEDIUMWordPress Thim Elementor Kit plugin <= 1.2.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-39460MEDIUMWordPress Eduma theme <= 5.6.4 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2024-2115HIGHLearnPress – WordPress LMS Plugin <= 4.0.0 - Cross-Site Request Forgery to Privilege EscalationEPSS 0.3%CVE-2026-1870MEDIUMThim Kit for Elementor <= 1.3.7 - Missing Authorization to Unauthenticated Private Course DisclosureEPSS 0.3%CVE-2025-13964MEDIUMLearnPress – WordPress LMS Plugin <= 4.3.2 - Missing Authentication to Unauthenticated Course ModificationEPSS 0.3%CVE-2025-66054HIGHWordPress LearnPress plugin <= 4.2.9.4 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-1787MEDIUMLearnPress Export Import <= 4.1.0 - Missing Authentication to Unauthenticated Migrated Course DeletionEPSS 0.3%CVE-2026-3225MEDIUMLearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Answer DeletionEPSS 0.3%