Thimpress vulnerabilities
138 CVEs and advisories name Thimpress as an affected vendor, newest first. Follow it as a feed.
- CVE-2025-63011WordPress WP Hotel Booking plugin <= 2.2.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2025-67594WordPress Thim Elementor Kit plugin <= 1.3.3 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2025-67573WordPress Sailing theme < 4.4.6 - Broken Access Control vulnerability
- CVE-2025-67536WordPress LearnPress plugin <= 4.2.9.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2025-67526WordPress Sailing theme < 4.4.6 - Local File Inclusion vulnerability
- CVE-2025-11368LearnPress – WordPress LMS Plugin <= 4.2.9.4 - Missing Authorization to Unauthenticated Arbitrary Callback Execution to Information Exposure
- CVE-2025-60200WordPress LearnPress Export Import plugin <= 4.1.2 - Local File Inclusion vulnerability
- CVE-2025-54721WordPress Resca theme <= 3.0.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2025-64195WordPress Eduma theme <= 5.7.6 - Local File Inclusion vulnerability
- CVE-2025-64194WordPress Eduma theme <= 5.7.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2025-60227WordPress WP Pipes plugin <= 1.4.3 - Arbitrary File Deletion vulnerability
- CVE-2025-49992WordPress LearnPress Export Import plugin <= 4.0.9 - Cross Site Scripting (XSS) vulnerability
- CVE-2025-11372LearnPress – WordPress LMS Plugin <= 4.2.9.3 - Missing Authorization to Unauthenticated Database Table Manipulation
- CVE-2025-57987WordPress WP Events Manager Plugin <= 2.2.1 - Broken Access Control Vulnerability
- CVE-2025-28977WordPress WP Pipes Plugin <= 1.4.3 - Cross Site Scripting (XSS) Vulnerability
- CVE-2025-28979WordPress WP Pipes <= 1.4.3 - Local File Inclusion Vulnerability
- CVE-2025-28982WordPress WP Pipes plugin <= 1.4.3 - SQL Injection Vulnerability
- CVE-2025-48267WordPress WP Pipes plugin <= 1.4.2 - Arbitrary File Deletion Vulnerability
- CVE-2025-48336WordPress Course Builder < 3.6.6 - PHP Object Injection Vulnerability
- CVE-2025-39460WordPress Eduma theme <= 5.6.4 - Broken Access Control vulnerability
- CVE-2025-47664WordPress WP Pipes <= 1.4.2 - Server Side Request Forgery (SSRF) Vulnerability
- CVE-2025-47448WordPress WP Hotel Booking plugin <= 2.1.9 - Cross Site Request Forgery (CSRF) Vulnerability
- CVE-2025-39470WordPress Ivy School theme <= 1.6.0 - Local File Inclusion Vulnerability
- CVE-2025-22739WordPress LearnPress plugin <= 4.2.7.5 - Broken Access Control vulnerability
- CVE-2025-24740WordPress Learnpress plugin <= 4.2.7.1 - Open Redirection vulnerability
- CVE-2025-24601WordPress FundPress plugin <= 2.0.6 - PHP Object Injection vulnerability
- CVE-2024-13599LearnPress – WordPress LMS Plugin <= 4.2.7.5 - Authenticated (LP Instructor+) Stored Cross-Site Scripting via Lesson Name
- CVE-2025-24725WordPress Thim Elementor Kit Plugin <= 1.2.8 - Broken Access Control vulnerability
- CVE-2024-13447WP Hotel Booking <= 2.1.6 - Missing Authorization to Authenticated (Subscriber+) User Email Retrieval
- CVE-2024-12370WP Hotel Booking <= 2.1.5 - Missing Authorization