Vulnerabilidades em thimpress

135 resultados
Análise Vexday

Com 50 CVEs catalogadas e 6 de severidade crítica, o histórico de vulnerabilidades da ThimPress indica uma superfície de ataque que merece monitoramento contínuo, especialmente considerando que 7 novas ocorrências surgiram nos últimos 90 dias. A falha mais comum é CWE-862 (ausência de verificação de autorização), padrão que frequentemente permite que usuários não autenticados ou de baixo privilégio acessem funcionalidades restritas. A CVE mais perigosa ativa no momento, CVE-2024-8522, apresenta score EPSS de 0,6136, sinalizando probabilidade elevada de exploração em ambiente real; embora nenhuma CVE do vendor conste no catálogo CISA KEV — resultado abaixo da média geral —, a presença de 3 vulnerabilidades com PoC pública mantém o risco concreto para instalações desatualizadas.

CVE-2025-24740MEDIUMWordPress Learnpress plugin <= 4.2.7.1 - Open Redirection vulnerabilityEPSS 0.3%CVE-2026-11901MEDIUMWP Hotel Booking <= 2.3.1 - Unauthenticated Insufficient Verification of Data Authenticity to Payment Bypass via PayPal IPN HandlerEPSS 0.3%CVE-2026-115598MEDIUMWordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-63013MEDIUMWordPress WP Hotel Booking plugin <= 2.2.7 - Sensitive Data Exposure vulnerabilityEPSS 0.3%CVE-2025-67573MEDIUMWordPress Sailing theme < 4.4.6 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-49992HIGHWordPress LearnPress Export Import plugin <= 4.0.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-107744MEDIUMLearnPress <= 4.4.10 - Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via 'search-authors' AJAX ActionEPSS 0.2%CVE-2025-53345HIGHWordPress Thim Core plugin <= 2.3.3 - Arbitrary plugin Installation vulnerabilityEPSS 0.2%CVE-2026-42690MEDIUMWordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-28977HIGHWordPress WP Pipes Plugin <= 1.4.3 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-82024MEDIUMLearnPress WordPress Plugin < 4.4.6 Stored XSS via Quiz Question Answer TitlesEPSS 0.2%CVE-2025-54721HIGHWordPress Resca theme <= 3.0.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2023-40009MEDIUMWordPress WP Pipes Plugin <= 1.4.0 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.2%CVE-2025-14387MEDIUMLearnPress – WordPress LMS Plugin <= 4.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via get_profile_socialEPSS 0.2%CVE-2025-47664MEDIUMWordPress WP Pipes <= 1.4.2 - Server Side Request Forgery (SSRF) VulnerabilityEPSS 0.2%CVE-2026-92538MEDIUMLearnPress <= 4.4.7 - Reflected DOM-Based Cross-Site Scripting via 'orderby' ParameterEPSS 0.2%CVE-2026-3226MEDIUMLearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Notification TriggeringEPSS 0.2%CVE-2025-64194MEDIUMWordPress Eduma theme <= 5.7.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-63011MEDIUMWordPress WP Hotel Booking plugin <= 2.2.8 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-67594MEDIUMWordPress Thim Elementor Kit plugin <= 1.3.3 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.2%