Thimpress
133 CVEs across 27 Thimpress products. Browse Thimpress vulnerabilities, severities, and proof-of-concept exploits.
Thimpress products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-66458 | Critical | 9.3 | 2026-08-13 | Unauthenticated SQL Injection in RealPress <= 1.1.2 versions. |
CVE-2026-15464 | Medium | 6.4 | 2026-07-24 | The WP Hotel Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'widget_search' Shortcode Attribute in all versions up to, and inclu… |
CVE-2026-15094 | Medium | 6.1 | 2026-07-17 | The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'check_in_date' parameter in all versions up to, and includin… |
CVE-2026-13765 | High | 7.5 | 2026-07-17 | The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions u… |
CVE-2026-11901 | Medium | 5.3 | 2026-07-11 | The WP Hotel Booking plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in all versions up to, and including, 2.3.1. This is… |
CVE-2026-11392 | Medium | 6.1 | 2026-07-10 | The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'check_in_date' and 'check_out_date' parameters in all versio… |
CVE-2026-12732 | Medium | 6.4 | 2026-07-01 | The LearnPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class_wrapper_form' shortcode attribute in versions up to, and includ… |
CVE-2026-11988 | Medium | 6.5 | 2026-07-01 | The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions… |
CVE-2026-8502 | Medium | 5.3 | 2026-06-06 | The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions u… |
CVE-2026-7566 | Medium | 6.6 | 2026-06-06 | The LearnPress – Backup & Migration Tool plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.1.4 via deserializa… |
CVE-2026-7565 | Medium | 4.9 | 2026-06-06 | The LearnPress – Backup & Migration Tool plugin for WordPress is vulnerable to Arbitrary File Read via Directory Traversal in all versions up to, and including… |
CVE-2025-53346 | Medium | 4.3 | 2026-06-02 | Missing Authorization vulnerability in ThimPress Thim Core allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Thim Co… |
CVE-2025-53345 | High | 8.8 | 2026-06-02 | Missing Authorization vulnerability leading to code execution after installing malicious vulnerable plugin in ThimPress Thim Core. This issue affects Thim Cor… |
CVE-2026-48865 | High | 7.1 | 2026-06-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress LearnPress allows Reflected XSS. This issue af… |
CVE-2026-7648 | Medium | 4.3 | 2026-05-14 | The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to payment bypass through user-controlled key in al… |
CVE-2026-4650 | Medium | 5.3 | 2026-05-02 | The FundPress – WordPress Donation Plugin for WordPress is vulnerable to authorization bypass in versions up to and including 2.0.8. This is due to missing aut… |
CVE-2026-4365 | Critical | 9.1 | 2026-04-14 | The LearnPress plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the `delete_question_answer()` function in… |
CVE-2026-4333 | Medium | 6.4 | 2026-04-08 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'skin' attribute of the learn_press_courses sho… |
CVE-2026-25002 | High | 7.5 | 2026-03-25 | Authentication Bypass Using an Alternate Path or Channel vulnerability in ThimPress LearnPress – Sepay Payment learnpress-sepay-payment allows Authentication A… |
CVE-2026-3225 | Medium | 4.3 | 2026-03-23 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized deletion of quiz question answers due to a missing capability check in… |
CVE-2026-27065 | Critical | 9.8 | 2026-03-19 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThimPress BuilderPress builderpress al… |
CVE-2026-1870 | Medium | 5.3 | 2026-03-16 | The Thim Kit for Elementor – Pre-built Templates & Widgets for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing val… |
CVE-2026-3226 | Medium | 4.3 | 2026-03-12 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized email notification triggering due to missing capability checks on all… |
CVE-2026-1787 | Medium | 4.8 | 2026-02-21 | The LearnPress Export Import – WordPress extension for LearnPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability c… |
CVE-2026-27050 | Medium | 5.4 | 2026-02-19 | Cross-Site Request Forgery (CSRF) vulnerability in ThimPress RealPress realpress allows Cross Site Request Forgery.This issue affects RealPress: from n/a throu… |
CVE-2026-24361 | Medium | 6.5 | 2026-01-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress LearnPress – Course Review learnpress-course-re… |
CVE-2025-14798 | Medium | 5.3 | 2026-01-20 | The LearnPress – WordPress LMS Plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.3.2.4 via the get_item_… |
CVE-2025-13725 | Medium | 6.5 | 2026-01-17 | The Gutenberg Thim Blocks – Page Builder, Gutenberg Blocks for the Block Editor plugin for WordPress is vulnerable to arbitrary file reads in all versions up t… |
CVE-2025-14075 | Medium | 5.3 | 2026-01-17 | The WP Hotel Booking plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.7. This is due to the plugi… |
CVE-2025-14802 | Medium | 5.4 | 2026-01-07 | The LearnPress – WordPress LMS Plugin for WordPress is vulnerable to unauthorized file deletion in versions up to, and including, 4.3.2.2 via the /wp-json/lp/v… |
CVE-2025-13964 | Medium | 5.3 | 2026-01-06 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the catch_lp… |
CVE-2025-53344 | Medium | 4.3 | 2026-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in ThimPress Thim Core allows Cross Site Request Forgery.This issue affects Thim Core: from n/a through 2.3.3. |
CVE-2025-66054 | High | 7.5 | 2025-12-18 | Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec… |
CVE-2025-13956 | Medium | 5.3 | 2025-12-16 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the statistic func… |
CVE-2025-14387 | Medium | 6.4 | 2025-12-15 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.3.1 due to insu… |
CVE-2025-67594 | Medium | 4.3 | 2025-12-09 | Authorization Bypass Through User-Controlled Key vulnerability in ThimPress Thim Elementor Kit thim-elementor-kit allows Exploiting Incorrectly Configured Acce… |
CVE-2025-67573 | Medium | 5.3 | 2025-12-09 | Missing Authorization vulnerability in ThimPress Sailing sailing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sai… |
CVE-2025-67536 | Medium | 6.5 | 2025-12-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress LearnPress learnpress allows Stored XSS.This is… |
CVE-2025-67526 | High | 7.5 | 2025-12-09 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThimPress Sailing sailing allows PHP L… |
CVE-2025-63013 | Medium | 4.3 | 2025-12-09 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThimPress WP Hotel Booking wp-hotel-booking allows Retrieve Embedde… |
CVE-2025-63012 | Medium | 4.3 | 2025-12-09 | Cross-Site Request Forgery (CSRF) vulnerability in ThimPress WP Hotel Booking wp-hotel-booking allows Cross Site Request Forgery.This issue affects WP Hotel Bo… |
CVE-2025-63011 | Medium | 5.9 | 2025-12-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress WP Hotel Booking wp-hotel-booking allows DOM-Ba… |
CVE-2025-11368 | Medium | 5.3 | 2025-11-21 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 4.2.9.4. Thi… |
CVE-2025-60200 | High | 7.5 | 2025-11-06 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThimPress LearnPress Export Import lea… |
CVE-2025-54721 | High | 7.1 | 2025-11-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress Resca resca allows Reflected XSS.This issue aff… |
CVE-2025-64195 | High | 7.5 | 2025-10-29 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThimPress Eduma eduma allows PHP Local… |
CVE-2025-64194 | Medium | 6.5 | 2025-10-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress Eduma eduma allows Stored XSS.This issue affect… |
CVE-2025-60227 | High | 8.6 | 2025-10-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThimPress WP Pipes wp-pipes allows Path Traversal.This issue af… |
CVE-2025-49992 | High | 7.1 | 2025-10-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress LearnPress Export Import learnpress-import-expo… |
CVE-2025-11372 | Medium | 6.5 | 2025-10-18 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to modification of data in all versions up to, and including, 4.2.9.2. This is due to… |
CVE-2025-57987 | Medium | 5.3 | 2025-09-22 | Missing Authorization vulnerability in ThimPress WP Events Manager wp-events-manager allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2025-28977 | High | 7.1 | 2025-08-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress WP Pipes allows Reflected XSS. This issue affec… |
CVE-2025-28979 | High | 8.1 | 2025-08-14 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThimPress WP Pipes allows PHP Local Fi… |
CVE-2025-28982 | Critical | 9.3 | 2025-07-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ThimPress WP Pipes allows SQL Injection. This issue affec… |
CVE-2025-48267 | High | 8.6 | 2025-06-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThimPress WP Pipes allows Path Traversal. This issue affects WP… |
CVE-2025-48336 | Critical | 9.8 | 2025-05-29 | Deserialization of Untrusted Data vulnerability in ThimPress Course Builder course-builder allows Object Injection.This issue affects Course Builder: from n/a… |
CVE-2025-39460 | Medium | 5.3 | 2025-05-19 | Missing Authorization vulnerability in ThimPress Eduma eduma allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Eduma… |
CVE-2024-13128 | Medium | 4.8 | 2025-05-15 | The LearnPress WordPress plugin before 4.2.7.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to pe… |
CVE-2024-13127 | Medium | 4.8 | 2025-05-15 | The LearnPress WordPress plugin before 4.2.7.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to pe… |
CVE-2025-47664 | Medium | 4.4 | 2025-05-07 | Server-Side Request Forgery (SSRF) vulnerability in ThimPress WP Pipes allows Server Side Request Forgery. This issue affects WP Pipes: from n/a through 1.4.2. |
CVE-2025-47448 | Medium | 4.3 | 2025-05-07 | Cross-Site Request Forgery (CSRF) vulnerability in ThimPress WP Hotel Booking wp-hotel-booking allows Cross Site Request Forgery.This issue affects WP Hotel Bo… |
CVE-2025-39470 | High | 8.1 | 2025-04-18 | Path Traversal: '.../...//' vulnerability in ThimPress Ivy School ivy-school allows PHP Local File Inclusion.This issue affects Ivy School: from n/a through <=… |
CVE-2025-22739 | Medium | 5.3 | 2025-03-27 | Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec… |
CVE-2025-24740 | Medium | 4.7 | 2025-01-27 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in ThimPress LearnPress learnpress.This issue affects LearnPress: from n/a through <= 4.2.7.1. |
CVE-2025-24601 | Critical | 9.8 | 2025-01-27 | Deserialization of Untrusted Data vulnerability in ThimPress FundPress fundpress allows Object Injection.This issue affects FundPress: from n/a through <= 2.0… |
CVE-2024-13599 | Medium | 6.4 | 2025-01-25 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.2.7.5 due to in… |
CVE-2025-24725 | Medium | 4.3 | 2025-01-24 | Missing Authorization vulnerability in ThimPress Thim Elementor Kit thim-elementor-kit allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2024-13447 | Medium | 4.3 | 2025-01-22 | The WP Hotel Booking plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hotel_booking_load_order_user A… |
CVE-2024-12370 | Medium | 5.3 | 2025-01-17 | The WP Hotel Booking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check when adding rooms in all version… |
CVE-2025-22312 | Medium | 6.5 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress Thim Elementor Kit thim-elementor-kit allows DO… |
CVE-2024-9881 | Medium | 4.8 | 2024-12-12 | The LearnPress WordPress plugin before 4.2.7.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perf… |
CVE-2024-10010 | Medium | 4.8 | 2024-12-12 | The LearnPress WordPress plugin before 4.2.7.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perf… |
CVE-2024-12283 | Medium | 6.1 | 2024-12-11 | The WP Pipes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘x1’ parameter in all versions up to, and including, 1.4.1 due to ins… |
CVE-2024-11868 | Medium | 5.3 | 2024-12-10 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.7.3 via cl… |
CVE-2024-9609 | Medium | 6.1 | 2024-11-15 | The LearnPress Export Import – WordPress extension for LearnPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'learnpress_impo… |
CVE-2024-51582 | High | 7.5 | 2024-11-04 | Path Traversal: '.../...//' vulnerability in ThimPress WP Hotel Booking wp-hotel-booking allows PHP Local File Inclusion.This issue affects WP Hotel Booking: f… |
CVE-2024-7855 | High | 8.8 | 2024-10-02 | The WP Hotel Booking plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the update_review() function in all ve… |
CVE-2024-8529 | Critical | 10.0 | 2024-09-12 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_fields' parameter of the /wp-json/lp/v1/courses/archive-co… |
CVE-2024-8522 | Critical | 10.0 | 2024-09-12 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_only_fields' parameter of the /wp-json/learnpress/v1/cours… |
CVE-2024-7717 | High | 8.8 | 2024-08-31 | The WP Events Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including, 2.1.11 due… |
CVE-2024-39641 | Medium | 4.3 | 2024-08-26 | Cross-Site Request Forgery (CSRF) vulnerability in ThimPress LearnPress.This issue affects LearnPress: from n/a through 4.2.6.8.2. |
CVE-2024-39642 | Medium | 6.5 | 2024-08-13 | Authorization Bypass Through User-Controlled Key vulnerability in ThimPress LearnPress allows Accessing Functionality Not Properly Constrained by ACLs.This iss… |
CVE-2024-7548 | High | 8.8 | 2024-08-08 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'order' parameter in all versions up to, and inclu… |
CVE-2024-6589 | High | 8.8 | 2024-07-25 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.2.6.8.2 via the 'rende… |
CVE-2024-6099 | Medium | 5.3 | 2024-07-02 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthenticated bypass to user registration in versions up to, and including, 4.2.6… |
CVE-2024-6088 | Medium | 5.3 | 2024-07-02 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized user registration due to a missing capability check on the 'register'… |
CVE-2024-3605 | Critical | 10.0 | 2024-06-20 | The WP Hotel Booking plugin for WordPress is vulnerable to SQL Injection via the 'room_type' parameter of the /wphb/v1/rooms/search-rooms REST API endpoint in… |
CVE-2023-36516 | High | 7.6 | 2024-06-19 | Missing Authorization vulnerability in ThimPress LearnPress.This issue affects LearnPress: from n/a through 4.2.3. |
CVE-2023-36515 | High | 7.3 | 2024-06-19 | Missing Authorization vulnerability in ThimPress LearnPress.This issue affects LearnPress: from n/a through 4.2.3. |
CVE-2024-35697 | High | 7.1 | 2024-06-08 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ThimPress Eduma allows Reflected XSS.This issue af… |
CVE-2024-5483 | Medium | 5.3 | 2024-06-05 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.6.8 due to… |
CVE-2024-4971 | Medium | 6.4 | 2024-05-22 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in all versions up to, and in… |
CVE-2024-4444 | Medium | 5.3 | 2024-05-14 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to bypass to user registration in versions up to, and including, 4.2.6.5. This is due… |
CVE-2024-4434 | Critical | 9.8 | 2024-05-14 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the ‘term_id’ parameter in versions up to, and includi… |
CVE-2024-4397 | High | 8.8 | 2024-05-14 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_post_materi… |
CVE-2024-4329 | Medium | 6.4 | 2024-05-14 | The Thim Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.1.9 due… |
CVE-2024-4277 | Medium | 6.4 | 2024-05-14 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘layout_html’ parameter in all versions up to… |
CVE-2024-34415 | Medium | 6.5 | 2024-05-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress Thim Elementor Kit allows Stored XSS.This issue… |
CVE-2024-3560 | Medium | 6.4 | 2024-04-19 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the _id value in all versions up to, and including… |
CVE-2024-32588 | High | 7.1 | 2024-04-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress LearnPress Export Import allows Reflected XSS.T… |