Thimpress vulnerabilities
138 CVEs and advisories name Thimpress as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-52713WordPress LearnPress plugin <= 4.4.12 - Broken Access Control vulnerability
- CVE-2026-118054LearnPress <= 4.2.2 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'review_title' Parameter
- CVE-2026-42690WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability
- CVE-2026-115599WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability
- CVE-2026-115598WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability
- CVE-2026-115597WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability
- CVE-2026-113353LearnPress before 4.4.10 Missing Authorization via Legacy Editor AJAX Handlers
- CVE-2026-110363WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability
- CVE-2026-107744LearnPress <= 4.4.10 - Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via 'search-authors' AJAX Action
- CVE-2026-104736LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter
- CVE-2026-109208LearnPress <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' Parameters
- CVE-2026-104670WordPress LearnPress plugin <= 4.4.9 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-105397LearnPress WordPress Plugin through 4.4.9.1 Stored XSS via Quiz Question Hint and Explanation
- CVE-2026-92538LearnPress <= 4.4.7 - Reflected DOM-Based Cross-Site Scripting via 'orderby' Parameter
- CVE-2026-39717WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability
- CVE-2026-104403WordPress LearnPress plugin <= 4.4.9 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-93882LearnPress <= 4.4.8 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'item_id' Parameter
- CVE-2026-12230LearnPress <= 4.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'layout_custom_css'
- CVE-2026-82024LearnPress WordPress Plugin < 4.4.6 Stored XSS via Quiz Question Answer Titles
- CVE-2026-82023LearnPress WordPress Plugin < 4.4.6 Broken Object-Level Authorization via Quiz Answer Insert
- CVE-2026-77823LearnPress <= 4.4.4 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
- CVE-2026-75982LearnPress <= 4.4.4 - Missing Authorization to Authenticated (Editor+) Limited Option Update via 'field_name' Parameter
- CVE-2026-66458WordPress RealPress plugin <= 1.1.2 - SQL Injection vulnerability
- CVE-2026-15464WP Hotel Booking <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'widget_search' Shortcode Attribute
- CVE-2026-57397WordPress Coaching theme <= 3.9.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-15094WP Hotel Booking <= 2.3.2 - Reflected Cross-Site Scripting via 'check_in_date' Parameter
- CVE-2026-13765LearnPress <= 4.4.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure via /lp/v1/users/check-answer and /start-quiz REST Endpoints
- CVE-2026-11901WP Hotel Booking <= 2.3.1 - Unauthenticated Insufficient Verification of Data Authenticity to Payment Bypass via PayPal IPN Handler
- CVE-2026-11392WP Hotel Booking <= 2.3.1 - Reflected Cross-Site Scripting via 'check_in_date' and 'check_out_date' Parameters
- CVE-2026-12732LearnPress <= 4.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class_wrapper_form' Shortcode Attribute