Thimpress vulnerabilities

Products

• Learnpress 76
• Learnpress – Wordpress Lms Plugin For Create And Sell Online Courses 45
• Wp Hotel Booking 25
• Wp Hotel Booking 12
• Wp Pipes 9
• Wp Pipes 9
• Learnpress – Wordpress Lms Plugin 7
• Learnpress Export Import 5
• Eduma 4
• Learnpress – Backup & Migration Tool 4
• Thim Elementor Kit 4
• Wp Events Manager 4
• Thim Core 3
• Realpress 2
• Sailing 2
• Thim Kit For Elementor – Pre-built Templates & Widgets For Elementor 2

Newest

• thimpress learnpress WordPress LearnPress plugin <= 4.4.12 - Broken Access Control vulnerability CVE-2026-52713 5.4 MediumNovember 7, 2026
• thimpress learnpress – course review LearnPress <= 4.2.2 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'review_title' Parameter CVE-2026-118054 6.4 MediumNovember 7, 2026
• thimpress learnpress WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability CVE-2026-42690 5.4 MediumOctober 29, 2026
• thimpress learnpress WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability CVE-2026-115599 7.5 HighOctober 29, 2026
• thimpress learnpress WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability CVE-2026-115598 5.3 MediumOctober 26, 2026
• thimpress learnpress WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability CVE-2026-115597 5.4 MediumOctober 26, 2026
• thimpress learnpress LearnPress before 4.4.10 Missing Authorization via Legacy Editor AJAX Handlers CVE-2026-113353 5.3 MediumOctober 20, 2026
• thimpress learnpress WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability CVE-2026-110363 5.4 MediumOctober 19, 2026
• thimpress learnpress – wordpress lms plugin for create and sell online courses LearnPress <= 4.4.10 - Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via 'search-authors' AJAX Action CVE-2026-107744 6.5 MediumOctober 17, 2026
• thimpress learnpress – wordpress lms plugin for create and sell online courses LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter CVE-2026-104736 Public exploit 9.8 CriticalOctober 17, 2026
• thimpress learnpress – wordpress lms plugin for create and sell online courses LearnPress <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' Parameters CVE-2026-109208 7.2 HighOctober 17, 2026
• thimpress learnpress WordPress LearnPress plugin <= 4.4.9 - Cross Site Scripting (XSS) vulnerability CVE-2026-104670 7.1 HighOctober 6, 2026
• thimpress learnpress LearnPress WordPress Plugin through 4.4.9.1 Stored XSS via Quiz Question Hint and Explanation CVE-2026-105397 5.1 MediumOctober 5, 2026
• thimpress learnpress – wordpress lms plugin for create and sell online courses LearnPress <= 4.4.7 - Reflected DOM-Based Cross-Site Scripting via 'orderby' Parameter CVE-2026-92538 6.1 MediumOctober 3, 2026
• thimpress learnpress WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability CVE-2026-39717 4.3 MediumOctober 2, 2026
• thimpress learnpress WordPress LearnPress plugin <= 4.4.9 - Insecure Direct Object References (IDOR) vulnerability CVE-2026-104403 5.3 MediumOctober 2, 2026
• thimpress learnpress – wordpress lms plugin for create and sell online courses LearnPress <= 4.4.8 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'item_id' Parameter CVE-2026-93882 7.5 HighOctober 1, 2026
• thimpress learnpress LearnPress 4.4.3 - 4.4.6 - Unauthenticated Quiz Answer Disclosure via check-answer REST Endpoint CVE-2026-86446 3.7 LowSeptember 17, 2026
• thimpress learnpress LearnPress < 4.4.7 - Unauthenticated Unpublished Course Disclosure via REST API CVE-2026-86449 5.3 MediumSeptember 16, 2026
• thimpress learnpress LearnPress < 4.4.7 - Unauthenticated Order Data Disclosure via lp_download_order CVE-2026-86448 3.7 LowSeptember 16, 2026
• thimpress learnpress LearnPress < 4.4.7 - Unauthenticated Student Enrollment Disclosure via load_content_via_ajax CVE-2026-86447 5.3 MediumSeptember 16, 2026
• thimpress learnpress LearnPress < 4.4.7 - Unauthenticated Question Bank Disclosure via load_content_via_ajax CVE-2026-86445 5.3 MediumSeptember 16, 2026
• thimpress learnpress LearnPress < 4.4.7 - Reflected XSS via 'skin' Parameter CVE-2026-86444 7.1 HighSeptember 16, 2026
• thimpress learnpress – wordpress lms plugin for create and sell online courses LearnPress <= 4.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'layout_custom_css' CVE-2026-12230 6.4 MediumSeptember 8, 2026
• thimpress learnpress LearnPress WordPress Plugin < 4.4.6 Stored XSS via Quiz Question Answer Titles CVE-2026-82024 5.1 MediumSeptember 3, 2026
• thimpress learnpress LearnPress WordPress Plugin < 4.4.6 Broken Object-Level Authorization via Quiz Answer Insert CVE-2026-82023 5.3 MediumSeptember 3, 2026
• thimpress learnpress – wordpress lms plugin for create and sell online courses LearnPress <= 4.4.4 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter CVE-2026-77823 4.9 MediumSeptember 1, 2026
• thimpress learnpress LearnPress – Sepay Payment < 4.0.3 - Unauthenticated Order Status Disclosure CVE-2026-78125 5.3 MediumAugust 27, 2026
• thimpress learnpress – wordpress lms plugin for create and sell online courses LearnPress <= 4.4.4 - Missing Authorization to Authenticated (Editor+) Limited Option Update via 'field_name' Parameter CVE-2026-75982 4.4 MediumAugust 25, 2026
• thimpress realpress WordPress RealPress plugin <= 1.1.2 - SQL Injection vulnerability CVE-2026-66458 9.3 CriticalAugust 13, 2026
• thimpress learnpress LearnPress < 4.4.4 - Subscriber+ Sensitive Information Exposure via AI Assistant CVE-2026-12976 6.5 MediumAugust 12, 2026
• thimpress learnpress LearnPress < 4.4.4 - Instructor+ Server-Side Request Forgery via openai_apply_image_feature CVE-2026-12971 2.2 LowAugust 10, 2026
• thimpress wp events manager WP Events Manager < 2.2.5 - Unauthenticated Payment Bypass and Booking Status Update via IDOR CVE-2026-15148 5.3 MediumAugust 7, 2026
• thimpress wp events manager WP Events Manager < 2.2.5 - Subscriber+ Payment Bypass via 'qty' Parameter CVE-2026-14205 9.8 CriticalAugust 7, 2026
• thimpress wp hotel booking WP Hotel Booking < 2.3.3 - Unauthenticated Payment Bypass via Price Manipulation CVE-2026-15149 5.3 MediumAugust 6, 2026
• thimpress wp hotel booking WP Hotel Booking < 2.3.2 - Unauthenticated PayPal Payment Bypass CVE-2026-15152 5.3 MediumAugust 6, 2026
• thimpress wp hotel booking WP Hotel Booking < 2.3.2 - Hotel Manager+ SQL Injection via Booking List Search CVE-2026-15153 6.8 MediumJuly 30, 2026
• thimpress wp hotel booking WP Hotel Booking <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'widget_search' Shortcode Attribute CVE-2026-15464 6.4 MediumJuly 24, 2026
• thimpress learnpress LearnPress < 4.4.1 - Reflected XSS via c_search CVE-2026-12970 7.1 HighJuly 20, 2026
• thimpress wp hotel booking WP Hotel Booking <= 2.3.2 - Reflected Cross-Site Scripting via 'check_in_date' Parameter CVE-2026-15094 6.1 MediumJuly 17, 2026
• thimpress learnpress – wordpress lms plugin for create and sell online courses LearnPress <= 4.4.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure via /lp/v1/users/check-answer and /start-quiz REST Endpoints CVE-2026-13765 7.5 HighJuly 17, 2026
• thimpress wp hotel booking WP Hotel Booking <= 2.3.1 - Unauthenticated Insufficient Verification of Data Authenticity to Payment Bypass via PayPal IPN Handler CVE-2026-11901 5.3 MediumJuly 11, 2026
• thimpress wp hotel booking WP Hotel Booking <= 2.3.1 - Reflected Cross-Site Scripting via 'check_in_date' and 'check_out_date' Parameters CVE-2026-11392 6.1 MediumJuly 10, 2026
• thimpress learnpress – wordpress lms plugin for create and sell online courses LearnPress <= 4.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class_wrapper_form' Shortcode Attribute CVE-2026-12732 6.4 MediumJuly 1, 2026
• thimpress learnpress – wordpress lms plugin for create and sell online courses LearnPress <= 4.3.9.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'userId' Parameter CVE-2026-11988 6.5 MediumJuly 1, 2026
• thimpress wp hotel booking WP Hotel Booking < 2.3.1 - Subscriber+ Missing Authorization in Multiple AJAX Handlers CVE-2026-9822 6.5 MediumJune 19, 2026
• thimpress learnpress LearnPress < 4.3.7 - Unauthenticated Sensitive User Information Disclosure via REST API CVE-2026-8383 5.3 MediumJune 17, 2026
• thimpress learnpress – wordpress lms plugin for create and sell online courses LearnPress <= 4.3.6 - Unauthenticated Sensitive Information Exposure via 'c_status' and 'return_type' Parameters CVE-2026-8502 5.3 MediumJune 6, 2026
• thimpress learnpress – backup & migration tool LearnPress – Backup & Migration Tool <= 4.1.4 - Authenticated (Administrator+) PHP Object Injection via WXR XML File Upload CVE-2026-7566 6.6 MediumJune 6, 2026
• thimpress learnpress – backup & migration tool LearnPress <= 4.1.4 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'import-user-file' Parameter CVE-2026-7565 4.9 MediumJune 6, 2026
• Show olderLoading…