ThimPress
- Total products in the ecosystem
- 23
- Total vulnerabilities (90 days)
- 23
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/08/2026, ThimPress recorded 23 security vulnerabilities in the last 90 days across 4 products, including 6 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, LearnPress had the most security vulnerabilities in the ThimPress ecosystem, with 13 vulnerabilities—approximately 56.52% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-52713WordPress LearnPress plugin <= 4.4.12 - Broken Access Control vulnerabilityCVE-2026-118054LearnPress <= 4.2.2 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'review_title' ParameterCVE-2026-42690WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerabilityCVE-2026-115599WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerabilityCVE-2026-115598WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-52713WordPress LearnPress plugin <= 4.4.12 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes |
| Published11/07/2026 |
| SeverityMedium |
CVE-2026-118054LearnPress <= 4.2.2 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'review_title' Parameter | Exploitation statusNot confirmed | FixYes | Affected productLearnPress – Course Review | Published11/07/2026 | SeverityMedium |
|---|
CVE-2026-42690WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productLearnPress | Published10/29/2026 | SeverityMedium |
|---|
CVE-2026-115599WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productLearnPress | Published10/29/2026 | SeverityHigh |
|---|
CVE-2026-115598WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productLearnPress | Published10/26/2026 | SeverityMedium |
|---|
CVE-2026-115597WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productLearnPress | Published10/26/2026 | SeverityMedium |
|---|
CVE-2026-113353LearnPress before 4.4.10 Missing Authorization via Legacy Editor AJAX Handlers | Exploitation statusNot exploited | FixYes | Affected productLearnPress | Published10/20/2026 | SeverityMedium |
|---|
CVE-2026-110363WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productLearnPress | Published10/19/2026 | SeverityMedium |
|---|
CVE-2026-109208LearnPress <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' Parameters | Exploitation statusNot exploited | FixYes | Affected productLearnPress – WordPress LMS Plugin for Create and Sell Online Courses | Published10/17/2026 | SeverityHigh |
|---|
CVE-2026-107744LearnPress <= 4.4.10 - Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via 'search-authors' AJAX Action | Exploitation statusNot exploited | FixYes | Affected productLearnPress – WordPress LMS Plugin for Create and Sell Online Courses | Published10/17/2026 | SeverityMedium |
|---|
CVE-2026-104736LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter | Exploitation statusNot exploited | FixYes | Affected productLearnPress – WordPress LMS Plugin for Create and Sell Online Courses | Published10/17/2026 | SeverityCritical |
|---|
CVE-2026-104670WordPress LearnPress plugin <= 4.4.9 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productLearnPress | Published10/06/2026 | SeverityHigh |
|---|
CVE-2026-105397LearnPress WordPress Plugin through 4.4.9.1 Stored XSS via Quiz Question Hint and Explanation | Exploitation statusNot exploited | FixYes | Affected productLearnPress | Published10/05/2026 | SeverityMedium |
|---|
CVE-2026-92538LearnPress <= 4.4.7 - Reflected DOM-Based Cross-Site Scripting via 'orderby' Parameter | Exploitation statusNot exploited | FixYes | Affected productLearnPress – WordPress LMS Plugin for Create and Sell Online Courses | Published10/03/2026 | SeverityMedium |
|---|
CVE-2026-39717WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productLearnPress | Published10/02/2026 | SeverityMedium |
|---|
CVE-2026-104403WordPress LearnPress plugin <= 4.4.9 - Insecure Direct Object References (IDOR) vulnerability | Exploitation statusNot exploited | FixYes | Affected productLearnPress | Published10/02/2026 | SeverityMedium |
|---|
CVE-2026-93882LearnPress <= 4.4.8 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'item_id' Parameter | Exploitation statusNot exploited | FixYes | Affected productLearnPress – WordPress LMS Plugin for Create and Sell Online Courses | Published10/01/2026 | SeverityHigh |
|---|
CVE-2026-12230LearnPress <= 4.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'layout_custom_css' | Exploitation statusNot exploited | FixYes | Affected productLearnPress – WordPress LMS Plugin for Create and Sell Online Courses | Published09/08/2026 | SeverityMedium |
|---|
CVE-2026-82024LearnPress WordPress Plugin < 4.4.6 Stored XSS via Quiz Question Answer Titles | Exploitation statusNot exploited | FixYes | Affected productLearnPress | Published09/03/2026 | SeverityMedium |
|---|
CVE-2026-82023LearnPress WordPress Plugin < 4.4.6 Broken Object-Level Authorization via Quiz Answer Insert | Exploitation statusNot exploited | FixYes | Affected productLearnPress | Published09/03/2026 | SeverityMedium |
|---|
CVE-2026-77823LearnPress <= 4.4.4 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter | Exploitation statusNot exploited | FixYes | Affected productLearnPress – WordPress LMS Plugin for Create and Sell Online Courses | Published09/01/2026 | SeverityMedium |
|---|
CVE-2026-75982LearnPress <= 4.4.4 - Missing Authorization to Authenticated (Editor+) Limited Option Update via 'field_name' Parameter | Exploitation statusNot exploited | FixYes | Affected productLearnPress – WordPress LMS Plugin for Create and Sell Online Courses | Published08/25/2026 | SeverityMedium |
|---|
CVE-2026-66458WordPress RealPress plugin <= 1.1.2 - SQL Injection vulnerability | Exploitation statusNot exploited | FixYes | Affected productRealPress | Published08/13/2026 | SeverityCritical |
|---|
CVE-2026-15464WP Hotel Booking <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'widget_search' Shortcode Attribute | Exploitation statusNot exploited | FixYes | Affected productWP Hotel Booking | Published07/24/2026 | SeverityMedium |
|---|
CVE-2026-15094WP Hotel Booking <= 2.3.2 - Reflected Cross-Site Scripting via 'check_in_date' Parameter | Exploitation statusNot exploited | FixYes | Affected productWP Hotel Booking | Published07/17/2026 | SeverityMedium |
|---|
CVE-2026-13765LearnPress <= 4.4.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure via /lp/v1/users/check-answer and /start-quiz REST Endpoints | Exploitation statusNot exploited | FixYes | Affected productLearnPress – WordPress LMS Plugin for Create and Sell Online Courses | Published07/17/2026 | SeverityHigh |
|---|
CVE-2026-11901WP Hotel Booking <= 2.3.1 - Unauthenticated Insufficient Verification of Data Authenticity to Payment Bypass via PayPal IPN Handler | Exploitation statusNot exploited | FixYes | Affected productWP Hotel Booking | Published07/11/2026 | SeverityMedium |
|---|
CVE-2026-11392WP Hotel Booking <= 2.3.1 - Reflected Cross-Site Scripting via 'check_in_date' and 'check_out_date' Parameters | Exploitation statusNot exploited | FixYes | Affected productWP Hotel Booking | Published07/10/2026 | SeverityMedium |
|---|
CVE-2026-12732LearnPress <= 4.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class_wrapper_form' Shortcode Attribute | Exploitation statusNot exploited | FixYes | Affected productLearnPress – WordPress LMS Plugin for Create and Sell Online Courses | Published07/01/2026 | SeverityMedium |
|---|
CVE-2026-11988LearnPress <= 4.3.9.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'userId' Parameter | Exploitation statusNot exploited | FixYes | Affected productLearnPress – WordPress LMS Plugin for Create and Sell Online Courses | Published07/01/2026 | SeverityMedium |
|---|
CVE-2026-8502LearnPress <= 4.3.6 - Unauthenticated Sensitive Information Exposure via 'c_status' and 'return_type' Parameters | Exploitation statusNot exploited | FixYes | Affected productLearnPress – WordPress LMS Plugin for Create and Sell Online Courses | Published06/06/2026 | SeverityMedium |
|---|
CVE-2026-7566LearnPress – Backup & Migration Tool <= 4.1.4 - Authenticated (Administrator+) PHP Object Injection via WXR XML File Upload | Exploitation statusNot exploited | FixYes | Affected productLearnPress – Backup & Migration Tool | Published06/06/2026 | SeverityMedium |
|---|
CVE-2026-7565LearnPress <= 4.1.4 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'import-user-file' Parameter | Exploitation statusNot exploited | FixYes | Affected productLearnPress – Backup & Migration Tool | Published06/06/2026 | SeverityMedium |
|---|
CVE-2025-53346WordPress Thim Core Plugin <= 2.3.3 - Broken Access Control Vulnerability | Exploitation statusNot exploited | FixYes | Affected productThim Core | Published06/02/2026 | SeverityMedium |
|---|
CVE-2025-53345WordPress Thim Core plugin <= 2.3.3 - Arbitrary plugin Installation vulnerability | Exploitation statusNot exploited | FixYes | Affected productThim Core | Published06/02/2026 | SeverityHigh |
|---|
CVE-2026-48865WordPress LearnPress plugin <= 4.3.6 - Reflected Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productLearnPress | Published06/01/2026 | SeverityHigh |
|---|
CVE-2026-7648LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.5 - Authenticated (Subscriber+) Payment Bypass to Free Course Enrollment via 'quantity' Parameter | Exploitation statusNot exploited | FixYes | Affected productLearnPress – WordPress LMS Plugin for Create and Sell Online Courses | Published05/14/2026 | SeverityMedium |
|---|
CVE-2026-4650FundPress <= 2.0.8 - Missing Authorization to Unauthenticated Arbitrary Donation Status Modification via donate_action_status AJAX Handler | Exploitation statusNot exploited | FixYes | Affected productFundPress – WordPress Donation Plugin | Published05/02/2026 | SeverityMedium |
|---|
CVE-2026-4365LearnPress <= 4.3.2.8 - Missing Authorization to Unauthenticated Arbitrary Quiz Answer Deletion | Exploitation statusNot exploited | FixYes | Affected productLearnPress – WordPress LMS Plugin for Create and Sell Online Courses | Published04/14/2026 | SeverityCritical |
|---|
CVE-2026-4333LearnPress <= 4.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'skin' Shortcode Attribute | Exploitation statusNot exploited | FixYes | Affected productLearnPress – WordPress LMS Plugin for Create and Sell Online Courses | Published04/08/2026 | SeverityMedium |
|---|
CVE-2026-25002Authentication bypass in ThimPress LearnPress, Sepay Payment plugin | Exploitation statusNot exploited | FixYes | Affected productLearnPress – Sepay Payment | Published03/25/2026 | SeverityHigh |
|---|
CVE-2026-3225LearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Answer Deletion | Exploitation statusNot exploited | FixYes | Affected productLearnPress – WordPress LMS Plugin for Create and Sell Online Courses | Published03/23/2026 | SeverityMedium |
|---|
CVE-2026-27065WordPress BuilderPress plugin <= 2.0.1 - Local File Inclusion vulnerability | Exploitation statusNot exploited | FixYes | Affected productBuilderPress | Published03/19/2026 | SeverityCritical |
|---|
CVE-2026-1870Thim Kit for Elementor <= 1.3.7 - Missing Authorization to Unauthenticated Private Course Disclosure | Exploitation statusNot exploited | FixYes | Affected productThim Kit for Elementor – Pre-built Templates & Widgets for Elementor | Published03/14/2026 | SeverityMedium |
|---|
CVE-2026-3226LearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Notification Triggering | Exploitation statusNot exploited | FixYes | Affected productLearnPress – WordPress LMS Plugin for Create and Sell Online Courses | Published03/12/2026 | SeverityMedium |
|---|
CVE-2026-1787LearnPress Export Import <= 4.1.0 - Missing Authentication to Unauthenticated Migrated Course Deletion | Exploitation statusNot exploited | FixYes | Affected productLearnPress – Backup & Migration Tool | Published02/21/2026 | SeverityMedium |
|---|
CVE-2026-27050WordPress RealPress plugin <= 1.1.0 - Cross Site Request Forgery (CSRF) vulnerability | Exploitation statusNot exploited | FixYes | Affected productRealPress | Published02/19/2026 | SeverityMedium |
|---|
CVE-2026-24361WordPress LearnPress – Course Review plugin <= 4.1.9 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productLearnPress – Course Review | Published01/22/2026 | SeverityMedium |
|---|
CVE-2025-14798LearnPress – WordPress LMS Plugin <= 4.3.2.4 - Missing Authorization to Unauthenticated Sensitive User Information Disclosure via REST API | Exploitation statusNot exploited | FixYes | Affected productLearnPress – WordPress LMS Plugin for Create and Sell Online Courses | Published01/20/2026 | SeverityMedium |
|---|
CVE-2025-14075WP Hotel Booking <= 2.2.7 - Unauthenticated Sensitive Information Exposure via 'email' Parameter | Exploitation statusNot exploited | FixYes | Affected productWP Hotel Booking | Published01/17/2026 | SeverityMedium |
|---|
137 Results | Page 1 of 3