# cve.now: Thimpress

The newest entries naming Thimpress as an affected vendor (up to 200), of 138 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-52713](https://cve.now/CVE-2026-52713.md): WordPress LearnPress plugin \<= 4.4.12 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2026-118054](https://cve.now/CVE-2026-118054.md): LearnPress \<= 4.2.2 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'review\_title' Parameter (CVSS 6.4)
- [CVE-2026-42690](https://cve.now/CVE-2026-42690.md): WordPress LearnPress plugin \<= 4.4.10 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2026-115599](https://cve.now/CVE-2026-115599.md): WordPress LearnPress plugin \<= 4.4.11 - Broken Access Control vulnerability (CVSS 7.5)
- [CVE-2026-115598](https://cve.now/CVE-2026-115598.md): WordPress LearnPress plugin \<= 4.4.11 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-115597](https://cve.now/CVE-2026-115597.md): WordPress LearnPress plugin \<= 4.4.11 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2026-113353](https://cve.now/CVE-2026-113353.md): LearnPress before 4.4.10 Missing Authorization via Legacy Editor AJAX Handlers (CVSS 5.3)
- [CVE-2026-110363](https://cve.now/CVE-2026-110363.md): WordPress LearnPress plugin \<= 4.4.10 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2026-107744](https://cve.now/CVE-2026-107744.md): LearnPress \<= 4.4.10 - Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via 'search-authors' AJAX Action (CVSS 6.5)
- [CVE-2026-104736](https://cve.now/CVE-2026-104736.md): LearnPress \<= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter (CVSS 9.8)
- [CVE-2026-109208](https://cve.now/CVE-2026-109208.md): LearnPress \<= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order\_comments' Parameters (CVSS 7.2)
- [CVE-2026-104670](https://cve.now/CVE-2026-104670.md): WordPress LearnPress plugin \<= 4.4.9 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-105397](https://cve.now/CVE-2026-105397.md): LearnPress WordPress Plugin through 4.4.9.1 Stored XSS via Quiz Question Hint and Explanation (CVSS 5.1)
- [CVE-2026-92538](https://cve.now/CVE-2026-92538.md): LearnPress \<= 4.4.7 - Reflected DOM-Based Cross-Site Scripting via 'orderby' Parameter (CVSS 6.1)
- [CVE-2026-39717](https://cve.now/CVE-2026-39717.md): WordPress LearnPress plugin \<= 4.4.10 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-104403](https://cve.now/CVE-2026-104403.md): WordPress LearnPress plugin \<= 4.4.9 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.3)
- [CVE-2026-93882](https://cve.now/CVE-2026-93882.md): LearnPress \<= 4.4.8 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'item\_id' Parameter (CVSS 7.5)
- [CVE-2026-12230](https://cve.now/CVE-2026-12230.md): LearnPress \<= 4.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'layout\_custom\_css' (CVSS 6.4)
- [CVE-2026-82024](https://cve.now/CVE-2026-82024.md): LearnPress WordPress Plugin \< 4.4.6 Stored XSS via Quiz Question Answer Titles (CVSS 5.1)
- [CVE-2026-82023](https://cve.now/CVE-2026-82023.md): LearnPress WordPress Plugin \< 4.4.6 Broken Object-Level Authorization via Quiz Answer Insert (CVSS 5.3)
- [CVE-2026-77823](https://cve.now/CVE-2026-77823.md): LearnPress \<= 4.4.4 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter (CVSS 4.9)
- [CVE-2026-75982](https://cve.now/CVE-2026-75982.md): LearnPress \<= 4.4.4 - Missing Authorization to Authenticated (Editor+) Limited Option Update via 'field\_name' Parameter (CVSS 4.4)
- [CVE-2026-66458](https://cve.now/CVE-2026-66458.md): WordPress RealPress plugin \<= 1.1.2 - SQL Injection vulnerability (CVSS 9.3)
- [CVE-2026-15464](https://cve.now/CVE-2026-15464.md): WP Hotel Booking \<= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'widget\_search' Shortcode Attribute (CVSS 6.4)
- [CVE-2026-57397](https://cve.now/CVE-2026-57397.md): WordPress Coaching theme \<= 3.9.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-15094](https://cve.now/CVE-2026-15094.md): WP Hotel Booking \<= 2.3.2 - Reflected Cross-Site Scripting via 'check\_in\_date' Parameter (CVSS 6.1)
- [CVE-2026-13765](https://cve.now/CVE-2026-13765.md): LearnPress \<= 4.4.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure via /lp/v1/users/check-answer and /start-quiz REST Endpoints (CVSS 7.5)
- [CVE-2026-11901](https://cve.now/CVE-2026-11901.md): WP Hotel Booking \<= 2.3.1 - Unauthenticated Insufficient Verification of Data Authenticity to Payment Bypass via PayPal IPN Handler (CVSS 5.3)
- [CVE-2026-11392](https://cve.now/CVE-2026-11392.md): WP Hotel Booking \<= 2.3.1 - Reflected Cross-Site Scripting via 'check\_in\_date' and 'check\_out\_date' Parameters (CVSS 6.1)
- [CVE-2026-12732](https://cve.now/CVE-2026-12732.md): LearnPress \<= 4.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class\_wrapper\_form' Shortcode Attribute (CVSS 6.4)
- [CVE-2026-11988](https://cve.now/CVE-2026-11988.md): LearnPress \<= 4.3.9.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'userId' Parameter (CVSS 6.5)
- [CVE-2026-8502](https://cve.now/CVE-2026-8502.md): LearnPress \<= 4.3.6 - Unauthenticated Sensitive Information Exposure via 'c\_status' and 'return\_type' Parameters (CVSS 5.3)
- [CVE-2026-7566](https://cve.now/CVE-2026-7566.md): LearnPress – Backup & Migration Tool \<= 4.1.4 - Authenticated (Administrator+) PHP Object Injection via WXR XML File Upload (CVSS 6.6)
- [CVE-2026-7565](https://cve.now/CVE-2026-7565.md): LearnPress \<= 4.1.4 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'import-user-file' Parameter (CVSS 4.9)
- [CVE-2025-53346](https://cve.now/CVE-2025-53346.md): WordPress Thim Core Plugin \<= 2.3.3 - Broken Access Control Vulnerability (CVSS 4.3)
- [CVE-2025-53345](https://cve.now/CVE-2025-53345.md): WordPress Thim Core plugin \<= 2.3.3 - Arbitrary plugin Installation vulnerability (CVSS 8.8)
- [CVE-2026-48865](https://cve.now/CVE-2026-48865.md): WordPress LearnPress plugin \<= 4.3.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-7648](https://cve.now/CVE-2026-7648.md): LearnPress – WordPress LMS Plugin for Create and Sell Online Courses \<= 4.3.5 - Authenticated (Subscriber+) Payment Bypass to Free Course Enrollment via 'quantity' Parameter (CVSS 4.3)
- [CVE-2026-4650](https://cve.now/CVE-2026-4650.md): FundPress \<= 2.0.8 - Missing Authorization to Unauthenticated Arbitrary Donation Status Modification via donate\_action\_status AJAX Handler (CVSS 5.3)
- [CVE-2026-4365](https://cve.now/CVE-2026-4365.md): LearnPress \<= 4.3.2.8 - Missing Authorization to Unauthenticated Arbitrary Quiz Answer Deletion (CVSS 9.1)
- [CVE-2026-4333](https://cve.now/CVE-2026-4333.md): LearnPress \<= 4.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'skin' Shortcode Attribute (CVSS 6.4)
- [CVE-2026-25002](https://cve.now/CVE-2026-25002.md): WordPress LearnPress – Sepay Payment plugin \<= 4.0.0 - Broken Authentication vulnerability (CVSS 7.5)
- [CVE-2026-3225](https://cve.now/CVE-2026-3225.md): LearnPress \<= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Answer Deletion (CVSS 4.3)
- [CVE-2026-27065](https://cve.now/CVE-2026-27065.md): WordPress BuilderPress plugin \<= 2.0.1 - Local File Inclusion vulnerability (CVSS 9.8)
- [CVE-2026-1870](https://cve.now/CVE-2026-1870.md): Thim Kit for Elementor \<= 1.3.7 - Missing Authorization to Unauthenticated Private Course Disclosure (CVSS 5.3)
- [CVE-2026-3226](https://cve.now/CVE-2026-3226.md): LearnPress \<= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Notification Triggering (CVSS 4.3)
- [CVE-2026-1787](https://cve.now/CVE-2026-1787.md): LearnPress Export Import \<= 4.1.0 - Missing Authentication to Unauthenticated Migrated Course Deletion (CVSS 4.8)
- [CVE-2026-27050](https://cve.now/CVE-2026-27050.md): WordPress RealPress plugin \<= 1.1.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4)
- [CVE-2026-24361](https://cve.now/CVE-2026-24361.md): WordPress LearnPress – Course Review plugin \<= 4.1.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-14798](https://cve.now/CVE-2025-14798.md): LearnPress – WordPress LMS Plugin \<= 4.3.2.4 - Missing Authorization to Unauthenticated Sensitive User Information Disclosure via REST API (CVSS 5.3)
- [CVE-2025-13725](https://cve.now/CVE-2025-13725.md): Gutenberg Thim Blocks \<= 1.0.1 - Authenticated (Contributor+) Arbitrary File Read via 'iconSVG' Parameter (CVSS 6.5)
- [CVE-2025-14075](https://cve.now/CVE-2025-14075.md): WP Hotel Booking \<= 2.2.7 - Unauthenticated Sensitive Information Exposure via 'email' Parameter (CVSS 5.3)
- [CVE-2025-14802](https://cve.now/CVE-2025-14802.md): LearnPress – WordPress LMS Plugin \<= 4.3.2.2 - Insecure Direct Object Reference to Authenticated (Instructor+) Teacher Material Deletion (CVSS 5.4)
- [CVE-2025-13964](https://cve.now/CVE-2025-13964.md): LearnPress – WordPress LMS Plugin \<= 4.3.2 - Missing Authentication to Unauthenticated Course Modification (CVSS 5.3)
- [CVE-2025-53344](https://cve.now/CVE-2025-53344.md): WordPress Thim Core Plugin \<= 2.3.3 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3)
- [CVE-2025-66054](https://cve.now/CVE-2025-66054.md): WordPress LearnPress plugin \<= 4.2.9.4 - Broken Access Control vulnerability (CVSS 7.5)
- [CVE-2025-13956](https://cve.now/CVE-2025-13956.md): LearnPress – WordPress LMS Plugin \<= 4.3.1 - Missing Authorization to Unauthenticated Orders Statistics Exposure (CVSS 5.3)
- [CVE-2025-14387](https://cve.now/CVE-2025-14387.md): LearnPress – WordPress LMS Plugin \<= 4.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via get\_profile\_social (CVSS 6.4)
- [CVE-2025-63013](https://cve.now/CVE-2025-63013.md): WordPress WP Hotel Booking plugin \<= 2.2.7 - Sensitive Data Exposure vulnerability (CVSS 4.3)
- [CVE-2025-63012](https://cve.now/CVE-2025-63012.md): WordPress WP Hotel Booking plugin \<= 2.2.8 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2025-63011](https://cve.now/CVE-2025-63011.md): WordPress WP Hotel Booking plugin \<= 2.2.8 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2025-67594](https://cve.now/CVE-2025-67594.md): WordPress Thim Elementor Kit plugin \<= 1.3.3 - Insecure Direct Object References (IDOR) vulnerability (CVSS 4.3)
- [CVE-2025-67573](https://cve.now/CVE-2025-67573.md): WordPress Sailing theme \< 4.4.6 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2025-67536](https://cve.now/CVE-2025-67536.md): WordPress LearnPress plugin \<= 4.2.9.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-67526](https://cve.now/CVE-2025-67526.md): WordPress Sailing theme \< 4.4.6 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2025-11368](https://cve.now/CVE-2025-11368.md): LearnPress – WordPress LMS Plugin \<= 4.2.9.4 - Missing Authorization to Unauthenticated Arbitrary Callback Execution to Information Exposure (CVSS 5.3)
- [CVE-2025-60200](https://cve.now/CVE-2025-60200.md): WordPress LearnPress Export Import plugin \<= 4.1.2 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2025-54721](https://cve.now/CVE-2025-54721.md): WordPress Resca theme \<= 3.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-64195](https://cve.now/CVE-2025-64195.md): WordPress Eduma theme \<= 5.7.6 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2025-64194](https://cve.now/CVE-2025-64194.md): WordPress Eduma theme \<= 5.7.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-60227](https://cve.now/CVE-2025-60227.md): WordPress WP Pipes plugin \<= 1.4.3 - Arbitrary File Deletion vulnerability (CVSS 8.6)
- [CVE-2025-49992](https://cve.now/CVE-2025-49992.md): WordPress LearnPress Export Import plugin \<= 4.0.9 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-11372](https://cve.now/CVE-2025-11372.md): LearnPress – WordPress LMS Plugin \<= 4.2.9.3 - Missing Authorization to Unauthenticated Database Table Manipulation (CVSS 6.5)
- [CVE-2025-57987](https://cve.now/CVE-2025-57987.md): WordPress WP Events Manager Plugin \<= 2.2.1 - Broken Access Control Vulnerability (CVSS 5.3)
- [CVE-2025-28977](https://cve.now/CVE-2025-28977.md): WordPress WP Pipes Plugin \<= 1.4.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1)
- [CVE-2025-28979](https://cve.now/CVE-2025-28979.md): WordPress WP Pipes \<= 1.4.3 - Local File Inclusion Vulnerability (CVSS 8.1)
- [CVE-2025-28982](https://cve.now/CVE-2025-28982.md): WordPress WP Pipes plugin \<= 1.4.3 - SQL Injection Vulnerability (CVSS 9.3)
- [CVE-2025-48267](https://cve.now/CVE-2025-48267.md): WordPress WP Pipes plugin \<= 1.4.2 - Arbitrary File Deletion Vulnerability (CVSS 8.6)
- [CVE-2025-48336](https://cve.now/CVE-2025-48336.md): WordPress Course Builder \< 3.6.6 - PHP Object Injection Vulnerability (CVSS 9.8)
- [CVE-2025-39460](https://cve.now/CVE-2025-39460.md): WordPress Eduma theme \<= 5.6.4 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2025-47664](https://cve.now/CVE-2025-47664.md): WordPress WP Pipes \<= 1.4.2 - Server Side Request Forgery (SSRF) Vulnerability (CVSS 4.4)
- [CVE-2025-47448](https://cve.now/CVE-2025-47448.md): WordPress WP Hotel Booking plugin \<= 2.1.9 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3)
- [CVE-2025-39470](https://cve.now/CVE-2025-39470.md): WordPress Ivy School theme \<= 1.6.0 - Local File Inclusion Vulnerability (CVSS 8.1)
- [CVE-2025-22739](https://cve.now/CVE-2025-22739.md): WordPress LearnPress plugin \<= 4.2.7.5 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2025-24740](https://cve.now/CVE-2025-24740.md): WordPress Learnpress plugin \<= 4.2.7.1 - Open Redirection vulnerability (CVSS 4.7)
- [CVE-2025-24601](https://cve.now/CVE-2025-24601.md): WordPress FundPress plugin \<= 2.0.6 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2024-13599](https://cve.now/CVE-2024-13599.md): LearnPress – WordPress LMS Plugin \<= 4.2.7.5 - Authenticated (LP Instructor+) Stored Cross-Site Scripting via Lesson Name (CVSS 6.4)
- [CVE-2025-24725](https://cve.now/CVE-2025-24725.md): WordPress Thim Elementor Kit Plugin \<= 1.2.8 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2024-13447](https://cve.now/CVE-2024-13447.md): WP Hotel Booking \<= 2.1.6 - Missing Authorization to Authenticated (Subscriber+) User Email Retrieval (CVSS 4.3)
- [CVE-2024-12370](https://cve.now/CVE-2024-12370.md): WP Hotel Booking \<= 2.1.5 - Missing Authorization (CVSS 5.3)
- [CVE-2025-22312](https://cve.now/CVE-2025-22312.md): WordPress Thim Elementor Kit plugin \<= 1.2.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-12283](https://cve.now/CVE-2024-12283.md): WP Pipes \<= 1.4.1 - Reflected Cross-Site Scripting via x1 Parameter (CVSS 6.1)
- [CVE-2024-11868](https://cve.now/CVE-2024-11868.md): LearnPress – WordPress LMS Plugin \<= 4.2.7.3 - Course Material Sensitive Information Exposure via REST API (CVSS 5.3)
- [CVE-2024-9609](https://cve.now/CVE-2024-9609.md): LearnPress Export Import – WordPress extension for LearnPress \<= 4.0.4 - Reflected Cross-Site Scripting (CVSS 6.1)
- [CVE-2024-51582](https://cve.now/CVE-2024-51582.md): WordPress WP Hotel Booking plugin \<= 2.2.9 - Local File Inclusion vulnerability (CVSS 7.5)
- [CVE-2024-7855](https://cve.now/CVE-2024-7855.md): WP Hotel Booking \<= 2.1.2 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 8.8)
- [CVE-2024-8522](https://cve.now/CVE-2024-8522.md): LearnPress – WordPress LMS Plugin \<= 4.2.7 - Unauthenticated SQL Injection via 'c\_only\_fields' (CVSS 10.0)
- [CVE-2024-8529](https://cve.now/CVE-2024-8529.md): LearnPress – WordPress LMS Plugin \<= 4.2.7 - Unauthenticated SQL Injection via 'c\_fields' (CVSS 10.0)
- [CVE-2024-7717](https://cve.now/CVE-2024-7717.md): WP Events Manager \<= 2.1.11 - Authenticated (Subscriber+) Time-Based SQL Injection (CVSS 8.8)
- [CVE-2024-39641](https://cve.now/CVE-2024-39641.md): WordPress LearnPress plugin \<= 4.2.6.8.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2024-39642](https://cve.now/CVE-2024-39642.md): WordPress LearnPress plugin \<= 4.2.6.8.2 - Insecure Direct Object References (IDOR) vulnerability (CVSS 6.5)
- [CVE-2024-7548](https://cve.now/CVE-2024-7548.md): LearnPress – WordPress LMS Plugin \<= 4.2.6.9.3 - Authenticated (Contributor+) SQL Injection via order Parameter (CVSS 8.8)
- [CVE-2024-6589](https://cve.now/CVE-2024-6589.md): LearnPress \<= 4.2.6.8.2 - Authenticated (Contributor+) Local File Inclusion (CVSS 8.8)
- [CVE-2024-6099](https://cve.now/CVE-2024-6099.md): LearnPress – WordPress LMS Plugin \<= 4.2.6.8.1 - Unauthenticated Bypass to User Registration (CVSS 5.3)
- [CVE-2024-6088](https://cve.now/CVE-2024-6088.md): LearnPress – WordPress LMS Plugin \<= 4.2.6.8.1 - Missing Authorization to Unauthenticated User Registration Bypass (CVSS 5.3)
- [CVE-2024-3605](https://cve.now/CVE-2024-3605.md): WP Hotel Booking \<= 2.1.0 - Unauthenticated SQL Injection (CVSS 10.0)
- [CVE-2023-36515](https://cve.now/CVE-2023-36515.md): WordPress LearnPress plugin \<= 4.2.3 - Unauthenticated Broken Access Control vulnerability (CVSS 7.3)
- [CVE-2023-36516](https://cve.now/CVE-2023-36516.md): WordPress LearnPress plugin \<= 4.2.3 - Authenticated Broken Access Control vulnerability (CVSS 7.6)
- [CVE-2024-35697](https://cve.now/CVE-2024-35697.md): WordPress Eduma theme \<= 5.4.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2024-5483](https://cve.now/CVE-2024-5483.md): LearnPress – WordPress LMS Plugin \<= 4.2.6.8 - Basic Information Disclosure via JSON API (CVSS 5.3)
- [CVE-2024-4971](https://cve.now/CVE-2024-4971.md): LearnPress – WordPress LMS Plugin \<= 4.2.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter (CVSS 6.4)
- [CVE-2024-4329](https://cve.now/CVE-2024-4329.md): Thim Elementor Kit \<= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter (CVSS 6.4)
- [CVE-2024-4277](https://cve.now/CVE-2024-4277.md): LearnPress – WordPress LMS Plugin \<= 4.2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via layout\_html Parameter (CVSS 6.4)
- [CVE-2024-4444](https://cve.now/CVE-2024-4444.md): LearnPress – WordPress LMS Plugin \<= 4.2.6.5 - Unauthenticated Bypass to User Registration (CVSS 5.3)
- [CVE-2024-4434](https://cve.now/CVE-2024-4434.md): LearnPress – WordPress LMS Plugin \<= 4.2.6.5 - Unauthenticated Time-Based SQL Injection (CVSS 9.8)
- [CVE-2024-4397](https://cve.now/CVE-2024-4397.md): LearnPress – WordPress LMS Plugin \<= 4.2.6.5 - Authenticated (Instructor+) Arbitrary File Upload (CVSS 8.8)
- [CVE-2024-34415](https://cve.now/CVE-2024-34415.md): WordPress Thim Elementor Kit plugin \<= 1.1.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-3560](https://cve.now/CVE-2024-3560.md): LearnPress – WordPress LMS Plugin \<= 4.2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-32588](https://cve.now/CVE-2024-32588.md): WordPress LearnPress Export Import plugin \<= 4.0.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2024-1463](https://cve.now/CVE-2024-1463.md): LearnPress \<= 4.2.6.3 - Authenticated(LP Instructor+) Stored Cross-Site Scripting (CVSS 4.4)
- [CVE-2024-1289](https://cve.now/CVE-2024-1289.md): LearnPress \<= 4.2.6.3 - Insecure Direct Object Reference (CVSS 6.5)
- [CVE-2024-31241](https://cve.now/CVE-2024-31241.md): WordPress LearnPress Export Import plugin \<= 4.0.3 - Auth. SQL Injection vulnerability (CVSS 7.6)
- [CVE-2024-2115](https://cve.now/CVE-2024-2115.md): LearnPress – WordPress LMS Plugin \<= 4.0.0 - Cross-Site Request Forgery to Privilege Escalation (CVSS 8.8)
- [CVE-2024-30508](https://cve.now/CVE-2024-30508.md): WordPress WP Hotel Booking plugin \<= 2.0.9.2 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2023-6567](https://cve.now/CVE-2023-6567.md): LearnPress \<= 4.2.5.7 - Unauthenticated SQL Injection via order\_by (CVSS 9.8)
- [CVE-2023-6634](https://cve.now/CVE-2023-6634.md): LearnPress \<= 4.2.5.7 - Command Injection (CVSS 8.1)
- [CVE-2023-6223](https://cve.now/CVE-2023-6223.md): LearnPress \<= 4.2.5.7 - Insecure Direct Object Reference to Information Disclosure (CVSS 4.3)
- [CVE-2023-40009](https://cve.now/CVE-2023-40009.md): WordPress WP Pipes Plugin \<= 1.4.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4)
- [CVE-2020-36757](https://cve.now/CVE-2020-36757.md): WP Hotel Booking \<= 1.10.1 - Cross-Site Request Forgery Bypass (CVSS 4.3)
- [CVE-2023-30487](https://cve.now/CVE-2023-30487.md): WordPress LearnPress Export Import Plugin \<= 4.0.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1)
- [CVE-2022-45355](https://cve.now/CVE-2022-45355.md): WordPress WP Pipes Plugin \<= 1.33 is vulnerable to SQL Injection (SQLi) (CVSS 8.2)
- [CVE-2022-45820](https://cve.now/CVE-2022-45820.md): WordPress LearnPress Plugin \<= 4.1.7.3.2 is vulnerable to SQL Injection (CVSS 9.1)
- [CVE-2022-45808](https://cve.now/CVE-2022-45808.md): WordPress LearnPress Plugin \<= 4.1.7.3.2 is vulnerable to SQL Injection (CVSS 9.9)
- [CVE-2022-47615](https://cve.now/CVE-2022-47615.md): WordPress LearnPress Plugin \<= 4.1.7.3.2 is vulnerable to Local File Inclusion (CVSS 9.3)
- [CVE-2021-36852](https://cve.now/CVE-2021-36852.md): WordPress WP Hotel Booking plugin \<= 1.10.5 - Cross-Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2018-16175](https://cve.now/CVE-2018-16175.md): SQL injection vulnerability in the LearnPress prior to version 3.1.0 allows attacker with administrator rights to execute arbitrary SQL comm (no CVSS)
- [CVE-2018-16174](https://cve.now/CVE-2018-16174.md): Open redirect vulnerability in LearnPress prior to version 3.1.0 allows remote attackers to redirect users to arbitrary web sites and conduc (no CVSS)
- [CVE-2018-16173](https://cve.now/CVE-2018-16173.md): Cross-site scripting vulnerability in LearnPress prior to version 3.1.0 allows remote attackers to inject arbitrary web script or HTML via u (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/thimpress
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.