ThimPress
- Total products in the ecosystem
- 23
- Total vulnerabilities (90 days)
- 23
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/08/2026, ThimPress recorded 23 security vulnerabilities in the last 90 days across 4 products, including 6 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, LearnPress had the most security vulnerabilities in the ThimPress ecosystem, with 13 vulnerabilities—approximately 56.52% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2025-13725Gutenberg Thim Blocks <= 1.0.1 - Authenticated (Contributor+) Arbitrary File Read via 'iconSVG' ParameterCVE-2025-14802LearnPress – WordPress LMS Plugin <= 4.3.2.2 - Insecure Direct Object Reference to Authenticated (Instructor+) Teacher Material DeletionCVE-2025-13964LearnPress – WordPress LMS Plugin <= 4.3.2 - Missing Authentication to Unauthenticated Course ModificationCVE-2025-53344WordPress Thim Core Plugin <= 2.3.3 - Cross Site Request Forgery (CSRF) VulnerabilityCVE-2025-66054WordPress LearnPress plugin <= 4.2.9.4 - Broken Access Control vulnerability| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2025-13725Gutenberg Thim Blocks <= 1.0.1 - Authenticated (Contributor+) Arbitrary File Read via 'iconSVG' Parameter | Exploitation statusNot exploited | FixYes |
| Affected productThim Blocks |
| Published01/17/2026 |
| SeverityMedium |
CVE-2025-14802LearnPress – WordPress LMS Plugin <= 4.3.2.2 - Insecure Direct Object Reference to Authenticated (Instructor+) Teacher Material Deletion | Exploitation statusNot exploited | FixYes | Affected productLearnPress – WordPress LMS Plugin for Create and Sell Online Courses | Published01/07/2026 | SeverityMedium |
|---|
CVE-2025-13964LearnPress – WordPress LMS Plugin <= 4.3.2 - Missing Authentication to Unauthenticated Course Modification | Exploitation statusNot exploited | FixYes | Affected productLearnPress – WordPress LMS Plugin for Create and Sell Online Courses | Published01/06/2026 | SeverityMedium |
|---|
CVE-2025-53344WordPress Thim Core Plugin <= 2.3.3 - Cross Site Request Forgery (CSRF) Vulnerability | Exploitation statusNot exploited | FixYes | Affected productThim Core | Published01/05/2026 | SeverityMedium |
|---|
CVE-2025-66054WordPress LearnPress plugin <= 4.2.9.4 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productLearnPress | Published12/18/2025 | SeverityHigh |
|---|
CVE-2025-13956LearnPress – WordPress LMS Plugin <= 4.3.1 - Missing Authorization to Unauthenticated Orders Statistics Exposure | Exploitation statusNot exploited | FixYes | Affected productLearnPress – WordPress LMS Plugin for Create and Sell Online Courses | Published12/16/2025 | SeverityMedium |
|---|
CVE-2025-14387LearnPress – WordPress LMS Plugin <= 4.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via get_profile_social | Exploitation statusNot exploited | FixYes | Affected productLearnPress – WordPress LMS Plugin for Create and Sell Online Courses | Published12/15/2025 | SeverityMedium |
|---|
CVE-2025-67594WordPress Thim Elementor Kit plugin <= 1.3.3 - Insecure Direct Object References (IDOR) vulnerability | Exploitation statusNot exploited | FixYes | Affected productThim Elementor Kit | Published12/09/2025 | SeverityMedium |
|---|
CVE-2025-67573WordPress Sailing theme < 4.4.6 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productSailing | Published12/09/2025 | SeverityMedium |
|---|
CVE-2025-67536WordPress LearnPress plugin <= 4.2.9.4 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productLearnPress | Published12/09/2025 | SeverityMedium |
|---|
CVE-2025-67526WordPress Sailing theme < 4.4.6 - Local File Inclusion vulnerability | Exploitation statusNot exploited | FixYes | Affected productSailing | Published12/09/2025 | SeverityHigh |
|---|
CVE-2025-63013WordPress WP Hotel Booking plugin <= 2.2.7 - Sensitive Data Exposure vulnerability | Exploitation statusNot exploited | FixYes | Affected productWP Hotel Booking | Published12/09/2025 | SeverityMedium |
|---|
CVE-2025-63012WordPress WP Hotel Booking plugin <= 2.2.8 - Cross Site Request Forgery (CSRF) vulnerability | Exploitation statusNot exploited | FixYes | Affected productWP Hotel Booking | Published12/09/2025 | SeverityMedium |
|---|
CVE-2025-63011WordPress WP Hotel Booking plugin <= 2.2.8 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productWP Hotel Booking | Published12/09/2025 | SeverityMedium |
|---|
CVE-2025-11368LearnPress – WordPress LMS Plugin <= 4.2.9.4 - Missing Authorization to Unauthenticated Arbitrary Callback Execution to Information Exposure | Exploitation statusNot exploited | FixYes | Affected productLearnPress – WordPress LMS Plugin for Create and Sell Online Courses | Published11/21/2025 | SeverityMedium |
|---|
CVE-2025-60200WordPress LearnPress Export Import plugin <= 4.1.2 - Local File Inclusion vulnerability | Exploitation statusNot exploited | FixYes | Affected productLearnPress Export Import | Published11/06/2025 | SeverityHigh |
|---|
CVE-2025-54721WordPress Resca theme <= 3.0.2 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productResca | Published11/06/2025 | SeverityHigh |
|---|
CVE-2025-64195WordPress Eduma theme <= 5.7.6 - Local File Inclusion vulnerability | Exploitation statusNot exploited | FixYes | Affected productEduma | Published10/29/2025 | SeverityHigh |
|---|
CVE-2025-64194WordPress Eduma theme <= 5.7.6 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productEduma | Published10/29/2025 | SeverityMedium |
|---|
CVE-2025-60227WordPress WP Pipes plugin <= 1.4.3 - Arbitrary File Deletion vulnerability | Exploitation statusNot exploited | FixYes | Affected productWP Pipes | Published10/22/2025 | SeverityHigh |
|---|
CVE-2025-49992WordPress LearnPress Export Import plugin <= 4.0.9 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productLearnPress Export Import | Published10/22/2025 | SeverityHigh |
|---|
CVE-2025-11372LearnPress – WordPress LMS Plugin <= 4.2.9.3 - Missing Authorization to Unauthenticated Database Table Manipulation | Exploitation statusNot exploited | FixYes | Affected productLearnPress – WordPress LMS Plugin for Create and Sell Online Courses | Published10/18/2025 | SeverityMedium |
|---|
CVE-2025-57987WordPress WP Events Manager Plugin <= 2.2.1 - Broken Access Control Vulnerability | Exploitation statusNot exploited | FixYes | Affected productWP Events Manager | Published09/22/2025 | SeverityMedium |
|---|
CVE-2025-28977WordPress WP Pipes Plugin <= 1.4.3 - Cross Site Scripting (XSS) Vulnerability | Exploitation statusNot exploited | FixYes | Affected productWP Pipes | Published08/20/2025 | SeverityHigh |
|---|
CVE-2025-28979WordPress WP Pipes <= 1.4.3 - Local File Inclusion Vulnerability | Exploitation statusNot exploited | FixYes | Affected productWP Pipes | Published08/14/2025 | SeverityHigh |
|---|
CVE-2025-28982WordPress WP Pipes plugin <= 1.4.3 - SQL Injection Vulnerability | Exploitation statusNot exploited | FixYes | Affected productWP Pipes | Published07/16/2025 | SeverityCritical |
|---|
CVE-2025-48267WordPress WP Pipes plugin <= 1.4.2 - Arbitrary File Deletion Vulnerability | Exploitation statusNot exploited | FixYes | Affected productWP Pipes | Published06/09/2025 | SeverityHigh |
|---|
CVE-2025-48336WordPress Course Builder < 3.6.6 - PHP Object Injection Vulnerability | Exploitation statusNot exploited | FixYes | Affected productCourse Builder | Published05/29/2025 | SeverityCritical |
|---|
CVE-2025-39460WordPress Eduma theme <= 5.6.4 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productEduma | Published05/19/2025 | SeverityMedium |
|---|
CVE-2025-47664WordPress WP Pipes <= 1.4.2 - Server Side Request Forgery (SSRF) Vulnerability | Exploitation statusNot exploited | FixYes | Affected productWP Pipes | Published05/07/2025 | SeverityMedium |
|---|
CVE-2025-47448WordPress WP Hotel Booking plugin <= 2.1.9 - Cross Site Request Forgery (CSRF) Vulnerability | Exploitation statusNot exploited | FixYes | Affected productWP Hotel Booking | Published05/07/2025 | SeverityMedium |
|---|
CVE-2025-39470WordPress Ivy School theme <= 1.6.0 - Local File Inclusion Vulnerability | Exploitation statusNot exploited | FixYes | Affected productIvy School | Published04/18/2025 | SeverityHigh |
|---|
CVE-2025-22739WordPress LearnPress plugin <= 4.2.7.5 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productLearnPress | Published03/27/2025 | SeverityMedium |
|---|
CVE-2025-24740WordPress Learnpress plugin <= 4.2.7.1 - Open Redirection vulnerability | Exploitation statusNot exploited | FixYes | Affected productLearnPress | Published01/27/2025 | SeverityMedium |
|---|
CVE-2025-24601WordPress FundPress plugin <= 2.0.6 - PHP Object Injection vulnerability | Exploitation statusNot exploited | FixYes | Affected productFundPress | Published01/27/2025 | SeverityCritical |
|---|
CVE-2024-13599LearnPress – WordPress LMS Plugin <= 4.2.7.5 - Authenticated (LP Instructor+) Stored Cross-Site Scripting via Lesson Name | Exploitation statusNot exploited | FixYes | Affected productLearnPress – WordPress LMS Plugin for Create and Sell Online Courses | Published01/25/2025 | SeverityMedium |
|---|
CVE-2025-24725WordPress Thim Elementor Kit Plugin <= 1.2.8 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productThim Elementor Kit | Published01/24/2025 | SeverityMedium |
|---|
CVE-2024-13447WP Hotel Booking <= 2.1.6 - Missing Authorization to Authenticated (Subscriber+) User Email Retrieval | Exploitation statusNot exploited | FixYes | Affected productWP Hotel Booking | Published01/22/2025 | SeverityMedium |
|---|
CVE-2024-12370WP Hotel Booking <= 2.1.5 - Missing Authorization | Exploitation statusNot exploited | FixYes | Affected productWP Hotel Booking | Published01/17/2025 | SeverityMedium |
|---|
CVE-2025-22312WordPress Thim Elementor Kit plugin <= 1.2.9 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productThim Elementor Kit | Published01/07/2025 | SeverityMedium |
|---|
CVE-2024-12283WP Pipes <= 1.4.1 - Reflected Cross-Site Scripting via x1 Parameter | Exploitation statusNot exploited | FixYes | Affected productWP Pipes | Published12/11/2024 | SeverityMedium |
|---|
CVE-2024-11868LearnPress – WordPress LMS Plugin <= 4.2.7.3 - Course Material Sensitive Information Exposure via REST API | Exploitation statusNot exploited | FixYes | Affected productLearnPress – WordPress LMS Plugin for Create and Sell Online Courses | Published12/10/2024 | SeverityMedium |
|---|
CVE-2024-9609LearnPress Export Import – WordPress extension for LearnPress <= 4.0.4 - Reflected Cross-Site Scripting | Exploitation statusNot exploited | FixYes | Affected productLearnPress – Backup & Migration Tool | Published11/15/2024 | SeverityMedium |
|---|
CVE-2024-51582WordPress WP Hotel Booking plugin <= 2.2.9 - Local File Inclusion vulnerability | Exploitation statusNot exploited | FixYes | Affected productWP Hotel Booking | Published11/04/2024 | SeverityHigh |
|---|
CVE-2024-7855WP Hotel Booking <= 2.1.2 - Authenticated (Subscriber+) Arbitrary File Upload | Exploitation statusNot exploited | FixYes | Affected productWP Hotel Booking | Published10/02/2024 | SeverityHigh |
|---|
CVE-2024-8529LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_fields' | Exploitation statusNot exploited | FixYes | Affected productLearnPress – WordPress LMS Plugin for Create and Sell Online Courses | Published09/12/2024 | SeverityCritical |
|---|
CVE-2024-8522LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_only_fields' | Exploitation statusNot exploited | FixYes | Affected productLearnPress – WordPress LMS Plugin for Create and Sell Online Courses | Published09/12/2024 | SeverityCritical |
|---|
CVE-2024-7717WP Events Manager <= 2.1.11 - Authenticated (Subscriber+) Time-Based SQL Injection | Exploitation statusNot exploited | FixYes | Affected productWP Events Manager | Published08/31/2024 | SeverityHigh |
|---|
CVE-2024-39641WordPress LearnPress plugin <= 4.2.6.8.2 - Cross Site Request Forgery (CSRF) vulnerability | Exploitation statusNot exploited | FixYes | Affected productLearnPress | Published08/26/2024 | SeverityMedium |
|---|
CVE-2024-39642WordPress LearnPress plugin <= 4.2.6.8.2 - Insecure Direct Object References (IDOR) vulnerability | Exploitation statusNot exploited | FixYes | Affected productLearnPress | Published08/13/2024 | SeverityMedium |
|---|
137 Results | Page 2 of 3