Thimpress
Page 2 of 2 — Thimpress CVEs from a corpus of 133, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-1463 | Medium | 4.4 | 2024-04-09 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Course, Lesson, and Quiz title and content in a… |
CVE-2024-1289 | Medium | 6.5 | 2024-04-09 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.6.3 due… |
CVE-2024-31241 | High | 7.6 | 2024-04-07 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ThimPress LearnPress Export Import.This issue affects Lea… |
CVE-2024-2115 | High | 8.8 | 2024-04-05 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.0.0. This is due… |
CVE-2024-30508 | Medium | 6.5 | 2024-03-29 | Missing Authorization vulnerability in ThimPress WP Hotel Booking.This issue affects WP Hotel Booking: from n/a through 2.0.9.2. |
CVE-2023-5558 | Medium | 6.1 | 2024-01-16 | The LearnPress WordPress plugin before 4.2.5.5 does not sanitise and escape user input before outputting it back in the page, leading to a Reflected Cross-Site… |
CVE-2023-6634 | High | 8.1 | 2024-01-11 | The LearnPress plugin for WordPress is vulnerable to Command Injection in all versions up to, and including, 4.2.5.7 via the get_content function. This is due… |
CVE-2023-6567 | Critical | 9.8 | 2024-01-11 | The LearnPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order_by’ parameter in all versions up to, and including, 4.2.5.7 due to… |
CVE-2023-6223 | Medium | 4.3 | 2024-01-11 | The LearnPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.5.7 via the /wp-json/lp/v1/prof… |
CVE-2023-5799 | Medium | 5.4 | 2023-11-20 | The WP Hotel Booking WordPress plugin before 2.0.8 does not have proper authorisation when deleting a package, allowing Contributor and above roles to delete p… |
CVE-2023-5652 | Critical | 9.8 | 2023-11-20 | The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not escape user input before using it in a SQL… |
CVE-2023-5651 | Medium | 5.4 | 2023-11-20 | The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not ensure that the package to be deleted is a… |
CVE-2023-40009 | Medium | 5.4 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in ThimPress WP Pipes plugin <= 1.4.0 versions. |
CVE-2020-36757 | Medium | 4.3 | 2023-07-12 | The WP Hotel Booking plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.10.1. This is due to missing or incor… |
CVE-2023-30487 | High | 7.1 | 2023-05-18 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ThimPress LearnPress Export Import plugin <= 4.0.2 versions. |
CVE-2022-45355 | High | 8.2 | 2023-03-29 | Auth. (admin+) SQL Injection (SQLi) vulnerability in ThimPress WP Pipes plugin <= 1.33 versions. |
CVE-2022-47615 | Critical | 9.3 | 2023-01-26 | Local File Inclusion vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions. |
CVE-2022-45820 | Critical | 9.1 | 2023-01-26 | SQL Injection (SQLi) vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions. |
CVE-2022-45808 | Critical | 9.9 | 2023-01-26 | SQL Injection vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions. |
CVE-2022-3360 | High | 8.1 | 2022-10-31 | The LearnPress WordPress plugin before 4.1.7.2 unserialises user input in a REST API endpoint available to unauthenticated users, which could lead to PHP Objec… |
CVE-2021-36852 | Medium | 4.3 | 2022-08-22 | Cross-Site Request Forgery (CSRF) vulnerability in ThimPress WP Hotel Booking plugin <= 1.10.5 at WordPress. |
CVE-2022-0271 | Medium | 6.1 | 2022-04-11 | The LearnPress WordPress plugin before 4.1.6 does not sanitise and escape the lp-dismiss-notice before outputting it back via the lp_background_single_email AJ… |
CVE-2022-0377 | Medium | 4.3 | 2022-02-28 | Users of the LearnPress WordPress plugin before 4.1.5 can upload an image as a profile avatar after the registration. After this process the user crops and sa… |
CVE-2021-24951 | Critical | 9.8 | 2021-12-13 | The LearnPress WordPress plugin before 4.1.4 does not sanitise, validate and escape the id parameter before using it in SQL statements when duplicating course/… |
CVE-2021-39348 | Medium | 5.5 | 2021-10-21 | The LearnPress WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping on the $custom_profile parameter found in the ~/inc/a… |
CVE-2021-24702 | Medium | 4.8 | 2021-10-18 | The LearnPress WordPress plugin before 4.1.3.1 does not properly sanitize or escape various inputs within course settings, which could allow high privilege use… |
CVE-2020-11511 | High | 8.1 | 2021-07-30 | The LearnPress plugin before 3.2.6.9 for WordPress allows remote attackers to escalate the privileges of any user to LP Instructor via the accept-to-be-teacher… |
CVE-2020-29047 | Critical | 9.8 | 2021-03-03 | The wp-hotel-booking plugin through 1.10.2 for WordPress allows remote attackers to execute arbitrary code because of an unserialize operation on the thimpress… |
CVE-2020-6010 | High | 8.8 | 2020-04-30 | LearnPress Wordpress plugin version prior and including 3.2.6.7 is vulnerable to SQL Injection |
CVE-2020-7916 | Medium | 6.5 | 2020-03-16 | be_teacher in class-lp-admin-ajax.php in the LearnPress plugin 3.2.6.5 and earlier for WordPress allows any registered user to assign itself the teacher role v… |
CVE-2018-16175 | High | 7.2 | 2019-01-09 | SQL injection vulnerability in the LearnPress prior to version 3.1.0 allows attacker with administrator rights to execute arbitrary SQL commands via unspecifie… |
CVE-2018-16174 | Medium | 6.1 | 2019-01-09 | Open redirect vulnerability in LearnPress prior to version 3.1.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks… |
CVE-2018-16173 | Medium | 6.1 | 2019-01-09 | Cross-site scripting vulnerability in LearnPress prior to version 3.1.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |