thimpress Vulnerabilities and Affected Products

Products

LearnPress – WordPress LMS Plugin for Create and Sell Online Courses37 vulnerabilities
learnpress30 vulnerabilities
WP Hotel Booking17 vulnerabilities
WP Pipes9 vulnerabilities
LearnPress Export Import5 vulnerabilities
wp_hotel_booking5 vulnerabilities
Eduma4 vulnerabilities
LearnPress – Backup & Migration Tool4 vulnerabilities
Thim Elementor Kit4 vulnerabilities
LearnPress – WordPress LMS Plugin3 vulnerabilities
Thim Core3 vulnerabilities
RealPress2 vulnerabilities
Sailing2 vulnerabilities
Thim Kit for Elementor – Pre-built Templates & Widgets for Elementor2 vulnerabilities
WP Events Manager2 vulnerabilities
BuilderPress1 vulnerability
Course Builder1 vulnerability
FundPress1 vulnerability
FundPress – WordPress Donation Plugin1 vulnerability
Ivy School1 vulnerability
LearnPress – Course Review1 vulnerability
LearnPress – Sepay Payment1 vulnerability
Resca1 vulnerability
Thim Blocks1 vulnerability
wp_events_manager1 vulnerability

thimpress vulnerability results
Vulnerability	Title and context	CVSS	EPSS	PoCs	Signals	STIX action
CVE-2025-60227HIGH	WordPress WP Pipes plugin <= 1.4.3 - Arbitrary File Deletion vulnerability Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThimPress WP Pipes wp-pipes allows Path Traversal.This issue affects WP Pipes: from n/a through <= 1.4.3. CWE-22Oct 22, 2025	CVSS8.6v3.1	EPSS0.475%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-28977HIGH	WordPress WP Pipes Plugin <= 1.4.3 - Cross Site Scripting (XSS) Vulnerability Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress WP Pipes allows Reflected XSS. This issue affects WP Pipes: from n/a through 1.4.3. CWE-79Aug 20, 2025	CVSS7.1v3.1	EPSS0.237%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-28979HIGH	WordPress WP Pipes <= 1.4.3 - Local File Inclusion Vulnerability Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThimPress WP Pipes allows PHP Local File Inclusion. This issue affects WP Pipes: from n/a through 1.4.3. CWE-98Aug 14, 2025	CVSS8.1v3.1	EPSS0.379%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-28982CRITICAL	WordPress WP Pipes plugin <= 1.4.3 - SQL Injection Vulnerability Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ThimPress WP Pipes allows SQL Injection. This issue affects WP Pipes: from n/a through 1.4.3. CWE-89Jul 16, 2025	CVSS9.3v3.1	EPSS0.409%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-48267HIGH	WordPress WP Pipes plugin <= 1.4.2 - Arbitrary File Deletion Vulnerability Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThimPress WP Pipes allows Path Traversal. This issue affects WP Pipes: from n/a through 1.4.2. CWE-22Jun 9, 2025	CVSS8.6v3.1	EPSS0.402%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-47664MEDIUM	WordPress WP Pipes <= 1.4.2 - Server Side Request Forgery (SSRF) Vulnerability Server-Side Request Forgery (SSRF) vulnerability in ThimPress WP Pipes allows Server Side Request Forgery. This issue affects WP Pipes: from n/a through 1.4.2. CWE-918May 7, 2025	CVSS4.4v3.1	EPSS0.215%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-12283MEDIUM	WP Pipes <= 1.4.1 - Reflected Cross-Site Scripting via x1 Parameter The WP Pipes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘x1’ parameter in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. CWE-79Dec 11, 2024	CVSS6.1v3.1	EPSS0.363%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2023-40009MEDIUM	WordPress WP Pipes Plugin <= 1.4.0 is vulnerable to Cross Site Request Forgery (CSRF) Cross-Site Request Forgery (CSRF) vulnerability in ThimPress WP Pipes plugin <= 1.4.0 versions. CWE-352Oct 3, 2023	CVSS5.4v3.1	EPSS0.202%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2022-45355HIGH	WordPress WP Pipes Plugin <= 1.33 is vulnerable to SQL Injection (SQLi) Auth. (admin+) SQL Injection (SQLi) vulnerability in ThimPress WP Pipes plugin <= 1.33 versions. CWE-89Mar 29, 2023	CVSS8.2v3.1	EPSS0.628%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX