Thimpress vulnerabilities
138 CVEs and advisories name Thimpress as an affected vendor, newest first. Follow it as a feed.
- CVE-2025-22312WordPress Thim Elementor Kit plugin <= 1.2.9 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-12283WP Pipes <= 1.4.1 - Reflected Cross-Site Scripting via x1 Parameter
- CVE-2024-11868LearnPress – WordPress LMS Plugin <= 4.2.7.3 - Course Material Sensitive Information Exposure via REST API
- CVE-2024-9609LearnPress Export Import – WordPress extension for LearnPress <= 4.0.4 - Reflected Cross-Site Scripting
- CVE-2024-51582WordPress WP Hotel Booking plugin <= 2.2.9 - Local File Inclusion vulnerability
- CVE-2024-7855WP Hotel Booking <= 2.1.2 - Authenticated (Subscriber+) Arbitrary File Upload
- CVE-2024-8522LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_only_fields'
- CVE-2024-8529LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_fields'
- CVE-2024-7717WP Events Manager <= 2.1.11 - Authenticated (Subscriber+) Time-Based SQL Injection
- CVE-2024-39641WordPress LearnPress plugin <= 4.2.6.8.2 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-39642WordPress LearnPress plugin <= 4.2.6.8.2 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2024-7548LearnPress – WordPress LMS Plugin <= 4.2.6.9.3 - Authenticated (Contributor+) SQL Injection via order Parameter
- CVE-2024-6589LearnPress <= 4.2.6.8.2 - Authenticated (Contributor+) Local File Inclusion
- CVE-2024-6099LearnPress – WordPress LMS Plugin <= 4.2.6.8.1 - Unauthenticated Bypass to User Registration
- CVE-2024-6088LearnPress – WordPress LMS Plugin <= 4.2.6.8.1 - Missing Authorization to Unauthenticated User Registration Bypass
- CVE-2024-3605WP Hotel Booking <= 2.1.0 - Unauthenticated SQL Injection
- CVE-2023-36515WordPress LearnPress plugin <= 4.2.3 - Unauthenticated Broken Access Control vulnerability
- CVE-2023-36516WordPress LearnPress plugin <= 4.2.3 - Authenticated Broken Access Control vulnerability
- CVE-2024-35697WordPress Eduma theme <= 5.4.7 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2024-5483LearnPress – WordPress LMS Plugin <= 4.2.6.8 - Basic Information Disclosure via JSON API
- CVE-2024-4971LearnPress – WordPress LMS Plugin <= 4.2.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
- CVE-2024-4329Thim Elementor Kit <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
- CVE-2024-4277LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via layout_html Parameter
- CVE-2024-4444LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Bypass to User Registration
- CVE-2024-4434LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Time-Based SQL Injection
- CVE-2024-4397LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Authenticated (Instructor+) Arbitrary File Upload
- CVE-2024-34415WordPress Thim Elementor Kit plugin <= 1.1.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-3560LearnPress – WordPress LMS Plugin <= 4.2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-32588WordPress LearnPress Export Import plugin <= 4.0.3 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2024-1463LearnPress <= 4.2.6.3 - Authenticated(LP Instructor+) Stored Cross-Site Scripting