Thimpress vulnerabilities
138 CVEs and advisories name Thimpress as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-11988LearnPress <= 4.3.9.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'userId' Parameter
- CVE-2026-8502LearnPress <= 4.3.6 - Unauthenticated Sensitive Information Exposure via 'c_status' and 'return_type' Parameters
- CVE-2026-7566LearnPress – Backup & Migration Tool <= 4.1.4 - Authenticated (Administrator+) PHP Object Injection via WXR XML File Upload
- CVE-2026-7565LearnPress <= 4.1.4 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'import-user-file' Parameter
- CVE-2025-53346WordPress Thim Core Plugin <= 2.3.3 - Broken Access Control Vulnerability
- CVE-2025-53345WordPress Thim Core plugin <= 2.3.3 - Arbitrary plugin Installation vulnerability
- CVE-2026-48865WordPress LearnPress plugin <= 4.3.6 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2026-7648LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.5 - Authenticated (Subscriber+) Payment Bypass to Free Course Enrollment via 'quantity' Parameter
- CVE-2026-4650FundPress <= 2.0.8 - Missing Authorization to Unauthenticated Arbitrary Donation Status Modification via donate_action_status AJAX Handler
- CVE-2026-4365LearnPress <= 4.3.2.8 - Missing Authorization to Unauthenticated Arbitrary Quiz Answer Deletion
- CVE-2026-4333LearnPress <= 4.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'skin' Shortcode Attribute
- CVE-2026-25002WordPress LearnPress – Sepay Payment plugin <= 4.0.0 - Broken Authentication vulnerability
- CVE-2026-3225LearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Answer Deletion
- CVE-2026-27065WordPress BuilderPress plugin <= 2.0.1 - Local File Inclusion vulnerability
- CVE-2026-1870Thim Kit for Elementor <= 1.3.7 - Missing Authorization to Unauthenticated Private Course Disclosure
- CVE-2026-3226LearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Notification Triggering
- CVE-2026-1787LearnPress Export Import <= 4.1.0 - Missing Authentication to Unauthenticated Migrated Course Deletion
- CVE-2026-27050WordPress RealPress plugin <= 1.1.0 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2026-24361WordPress LearnPress – Course Review plugin <= 4.1.9 - Cross Site Scripting (XSS) vulnerability
- CVE-2025-14798LearnPress – WordPress LMS Plugin <= 4.3.2.4 - Missing Authorization to Unauthenticated Sensitive User Information Disclosure via REST API
- CVE-2025-13725Gutenberg Thim Blocks <= 1.0.1 - Authenticated (Contributor+) Arbitrary File Read via 'iconSVG' Parameter
- CVE-2025-14075WP Hotel Booking <= 2.2.7 - Unauthenticated Sensitive Information Exposure via 'email' Parameter
- CVE-2025-14802LearnPress – WordPress LMS Plugin <= 4.3.2.2 - Insecure Direct Object Reference to Authenticated (Instructor+) Teacher Material Deletion
- CVE-2025-13964LearnPress – WordPress LMS Plugin <= 4.3.2 - Missing Authentication to Unauthenticated Course Modification
- CVE-2025-53344WordPress Thim Core Plugin <= 2.3.3 - Cross Site Request Forgery (CSRF) Vulnerability
- CVE-2025-66054WordPress LearnPress plugin <= 4.2.9.4 - Broken Access Control vulnerability
- CVE-2025-13956LearnPress – WordPress LMS Plugin <= 4.3.1 - Missing Authorization to Unauthenticated Orders Statistics Exposure
- CVE-2025-14387LearnPress – WordPress LMS Plugin <= 4.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via get_profile_social
- CVE-2025-63013WordPress WP Hotel Booking plugin <= 2.2.7 - Sensitive Data Exposure vulnerability
- CVE-2025-63012WordPress WP Hotel Booking plugin <= 2.2.8 - Cross Site Request Forgery (CSRF) vulnerability