Vendor
ThimPress
138 known vulnerabilities.
Products
138 results · Feed
-
Medium 6.5
LearnPress <= 4.2.6.3 - Insecure Direct Object Reference
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.6.3 due to missing validation on a user controlled key when looking up order information. This makes it poss…
-
High 7.6
WordPress LearnPress Export Import plugin <= 4.0.3 - Auth. SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ThimPress LearnPress Export Import.This issue affects LearnPress Export Import: from n/a through 4.0.3.
-
High 8.8
LearnPress – WordPress LMS Plugin <= 4.0.0 - Cross-Site Request Forgery to Privilege Escalation
The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.0.0. This is due to missing or incorrect nonce validation on the filter_users functions. This makes it possible for …
-
Medium 6.5
WordPress WP Hotel Booking plugin <= 2.0.9.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in ThimPress WP Hotel Booking.This issue affects WP Hotel Booking: from n/a through 2.0.9.2.
-
Critical 9.8
LearnPress <= 4.2.5.7 - Unauthenticated SQL Injection via order_by
The LearnPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order_by’ parameter in all versions up to, and including, 4.2.5.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the exis…
-
High 8.1
LearnPress <= 4.2.5.7 - Command Injection
The LearnPress plugin for WordPress is vulnerable to Command Injection in all versions up to, and including, 4.2.5.7 via the get_content function. This is due to the plugin making use of the call_user_func function with user input. This makes it possible for …
-
Medium 4.3
LearnPress <= 4.2.5.7 - Insecure Direct Object Reference to Information Disclosure
The LearnPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.5.7 via the /wp-json/lp/v1/profile/course-tab REST API due to missing validation on the 'userID' user controlled key. This makes it…
-
Medium 5.4
WordPress WP Pipes Plugin <= 1.4.0 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in ThimPress WP Pipes plugin <= 1.4.0 versions.
-
Medium 4.3
WP Hotel Booking <= 1.10.1 - Cross-Site Request Forgery Bypass
The WP Hotel Booking plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.10.1. This is due to missing or incorrect nonce validation on the admin_add_order_item() function. This makes it possible for unauthentic…
-
High 7.1
WordPress LearnPress Export Import Plugin <= 4.0.2 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ThimPress LearnPress Export Import plugin <= 4.0.2 versions.
-
High 8.2
WordPress WP Pipes Plugin <= 1.33 is vulnerable to SQL Injection (SQLi)
Auth. (admin+) SQL Injection (SQLi) vulnerability in ThimPress WP Pipes plugin <= 1.33 versions.
-
Critical 9.1
WordPress LearnPress Plugin <= 4.1.7.3.2 is vulnerable to SQL Injection
SQL Injection (SQLi) vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions.
-
Critical 9.9
WordPress LearnPress Plugin <= 4.1.7.3.2 is vulnerable to SQL Injection
SQL Injection vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions.
-
Critical 9.3
WordPress LearnPress Plugin <= 4.1.7.3.2 is vulnerable to Local File Inclusion
Local File Inclusion vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions.
-
Medium 4.3
WordPress WP Hotel Booking plugin <= 1.10.5 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in ThimPress WP Hotel Booking plugin <= 1.10.5 at WordPress.
-
Unscored —
Open redirect vulnerability in LearnPress prior to version 3.1.0 allows remote attackers to redirect users to arbitrary…
-
Unscored —
Cross-site scripting vulnerability in LearnPress prior to version 3.1.0 allows remote attackers to inject arbitrary web…
-
Unscored —
SQL injection vulnerability in the LearnPress prior to version 3.1.0 allows attacker with administrator rights to execu…