Log in Start free

ThimPress

Products

ProductCVEsExploitedLatest
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses45–Oct 17, 2026
LearnPress21–Oct 29, 2026
WP Hotel Booking17–Jul 24, 2026
WP Pipes9–Oct 22, 2025
LearnPress Export Import5–Nov 6, 2025
LearnPress – Backup & Migration Tool4–Jun 6, 2026
Thim Elementor Kit4–Dec 9, 2025
Eduma4–Oct 29, 2025
Thim Core3–Jun 2, 2026
LearnPress – WordPress LMS Plugin3–Jan 24, 2023
RealPress2–Aug 13, 2026
Sailing2–Dec 9, 2025
Thim Kit for Elementor – Pre-built Templates & Widgets for Elementor2–Mar 14, 2026
WP Events Manager2–Sep 22, 2025
LearnPress – Course Review2–Nov 7, 2026
BuilderPress1–Mar 19, 2026
FundPress – WordPress Donation Plugin1–May 2, 2026
Ivy School1–Apr 18, 2025
LearnPress – Sepay Payment1–Mar 25, 2026
Course Builder1–May 29, 2025
Resca1–Nov 6, 2025
Thim Blocks1–Jan 17, 2026
Coaching1–Jul 23, 2026
FundPress1–Jan 27, 2025

Exploited and recent CVEs

  • CVE-2026-118054 Medium 6.4 LearnPress <= 4.2.2 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'review_title' Parameter –
  • CVE-2026-42690 Medium 5.4 WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability 0.2%
  • CVE-2026-115599 High 7.5 WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability 0.3%
  • CVE-2026-115598 Medium 5.3 WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability 0.3%
  • CVE-2026-115597 Medium 5.4 WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability 0.2%
  • CVE-2026-113353 Medium 5.4 LearnPress before 4.4.10 Missing Authorization via Legacy Editor AJAX Handlers 0.3%
  • CVE-2026-110363 Medium 5.4 WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability 0.1%
  • CVE-2026-107744 Medium 6.5 LearnPress <= 4.4.10 - Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via 'search-authors' AJAX Action 0.2%
  • CVE-2026-104736 Critical 9.8 LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter 2.5%
  • CVE-2026-109208 High 7.2 LearnPress <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' Parameters 0.3%
  • CVE-2026-104670 High 7.1 WordPress LearnPress plugin <= 4.4.9 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-105397 Medium 5.4 LearnPress WordPress Plugin through 4.4.9.1 Stored XSS via Quiz Question Hint and Explanation 0.2%
  • CVE-2026-92538 Medium 6.1 LearnPress <= 4.4.7 - Reflected DOM-Based Cross-Site Scripting via 'orderby' Parameter 0.2%
  • CVE-2026-39717 Medium 4.3 WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability 0.2%
  • CVE-2026-104403 Medium 5.3 WordPress LearnPress plugin <= 4.4.9 - Insecure Direct Object References (IDOR) vulnerability 0.2%
  • CVE-2026-93882 High 7.5 LearnPress <= 4.4.8 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'item_id' Parameter 0.4%
  • CVE-2026-12230 Medium 6.4 LearnPress <= 4.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'layout_custom_css' 0.3%
  • CVE-2026-82024 Medium 5.4 LearnPress WordPress Plugin < 4.4.6 Stored XSS via Quiz Question Answer Titles 0.2%
  • CVE-2026-82023 Medium 4.3 LearnPress WordPress Plugin < 4.4.6 Broken Object-Level Authorization via Quiz Answer Insert 0.3%
  • CVE-2026-77823 Medium 4.9 LearnPress <= 4.4.4 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter 0.4%
  • CVE-2026-75982 Medium 4.4 LearnPress <= 4.4.4 - Missing Authorization to Authenticated (Editor+) Limited Option Update via 'field_name' Parameter 0.4%
  • CVE-2026-66458 Critical 9.3 WordPress RealPress plugin <= 1.1.2 - SQL Injection vulnerability 0.4%
  • CVE-2026-15464 Medium 6.4 WP Hotel Booking <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'widget_search' Shortcode Attribute 0.3%
  • CVE-2026-57397 High 7.1 WordPress Coaching theme <= 3.9.2 - Cross Site Scripting (XSS) vulnerability 0.3%
  • CVE-2026-15094 Medium 6.1 WP Hotel Booking <= 2.3.2 - Reflected Cross-Site Scripting via 'check_in_date' Parameter 0.7%
  • CVE-2026-13765 High 7.5 LearnPress <= 4.4.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure via /lp/v1/users/check-answer and /start-quiz REST Endpoints 0.7%
  • CVE-2026-11901 Medium 5.3 WP Hotel Booking <= 2.3.1 - Unauthenticated Insufficient Verification of Data Authenticity to Payment Bypass via PayPal IPN Handler 0.3%
  • CVE-2026-11392 Medium 6.1 WP Hotel Booking <= 2.3.1 - Reflected Cross-Site Scripting via 'check_in_date' and 'check_out_date' Parameters 0.4%
  • CVE-2026-12732 Medium 6.4 LearnPress <= 4.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class_wrapper_form' Shortcode Attribute 0.3%
  • CVE-2026-11988 Medium 6.5 LearnPress <= 4.3.9.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'userId' Parameter 0.5%