Thimpress
Monthly
Unauthenticated PHP object injection in the LearnPress WordPress LMS plugin through version 4.4.10 allows attackers to store a crafted serialized object via the checkout-email parameter, which LearnPress later deserializes without an allowed_classes restriction. The CVSS 3.1 score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but practical high-impact exploitation depends on a usable POP gadget chain in LearnPress, WordPress core, or another installed plugin/theme; no public exploit has been identified at time of analysis.
Stored cross-site scripting in the LearnPress WordPress LMS plugin (all versions up to and including 4.4.10) lets attackers plant arbitrary JavaScript that executes in a store administrator's browser when they open the affected order details or invoice export screens in wp-admin. Two injection points exist: the 'quantity' parameter handled by the frontend REST courses controller and the 'order_comments' field captured during checkout; the unauthenticated path depends on the site having guest checkout enabled, while sites with guest checkout disabled still expose both vectors to any Subscriber-level account. CISA KEV does not list this issue and no public exploit identified at time of analysis; exploitation requires the victimized operator to view a poisoned order or invoice page, which keeps it a credible but moderate-priority risk despite a 7.2 CVSS score reflecting scope change into the admin context.
Unauthenticated cross-site scripting in the LearnPress WordPress plugin through version 4.4.9 allows remote attackers to deliver script payloads that execute in a victim's browser once the victim is induced to interact with attacker-controlled input, typically by clicking a crafted link or rendering injected content produced by the plugin. No authentication is required to reach the vulnerable code (PR:N), but exploitation is not zero-click because it depends on victim interaction (UI:R); any publicly reachable WordPress site running a vulnerable LearnPress release is a candidate target in its default configuration. Patchstack reported the issue as a WordPress plugin XSS, no CISA KEV listing or EPSS score was supplied with the intelligence, and there is no public exploit identified at time of analysis.
Unauthenticated attackers can read and download course-material files - including uploaded file paths and external URLs - belonging to lessons in paid or enrollment-required LearnPress courses by exploiting an insecure direct object reference in the plugin's CourseMaterialTemplate::render_material_items() handler (CVE-2026-93882, CVSS 7.5, AV:N/AC:L/PR:N/UI:N). The handler validates authorization against one attacker-supplied identifier (course_id) but fetches material rows using a second, independently attacker-supplied identifier (item_id), with no check that the lesson actually belongs to the authorized course; the call is reachable through the public lp-ajax-handle (load_content_via_ajax) action, which sits on the AbstractAjax no-nonce allowlist and performs no capability check. Exploitation is conditional: at least one course on the target site must have 'No Required Enroll' enabled and own at least one material file, so that a valid course_id exists to satisfy the authorization branch while item_id is pointed at a restricted lesson. Impact is read-only confidentiality loss; no public exploit identified at time of analysis.
Unauthenticated SQL injection in the RealPress WordPress plugin (by ThimPress) affects all versions up to and including 1.1.2, letting remote attackers with no credentials inject crafted SQL through an exposed parameter and read arbitrary data from the site's database. Reported by Patchstack and rated CVSS 9.3, the flaw requires no authentication or user interaction, though there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The primary consequence is disclosure of sensitive database contents such as user records and credential hashes.
Cross-site scripting in the ThimPress "Coaching" WordPress theme (versions <= 3.9.2) lets remote unauthenticated attackers inject arbitrary script that executes in a victim's browser after they interact with a crafted link or page. Reported by Patchstack under CWE-79, the flaw carries a CVSS 3.1 score of 7.1 with a scope change, but there is no public exploit identified at time of analysis and no active-exploitation (KEV) or EPSS signal in the provided data. Impact is primarily session/account compromise of users who view attacker-controlled content within a site running the theme.
Sensitive information exposure in the LearnPress LMS plugin for WordPress (versions up to and including 4.4.1) lets unauthenticated attackers pull correct-answer markers, complete option lists, explanations, and full question content for any quiz on the site through the check_answer logic in its frontend REST API. This exposes graded assessment material for paid courses the attacker never enrolled in or paid for, defeating the plugin's course-access model. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the network-facing, no-authentication nature makes it trivially reproducible against affected sites.
Unauthenticated data deletion in LearnPress WordPress LMS plugin (versions ≤4.3.2.8) allows remote attackers to delete arbitrary quiz answer options without authentication. The plugin exposes wp_rest nonces to unauthenticated visitors in public frontend HTML and uses this nonce as the sole security gate for its AJAX dispatcher, while the delete_question_answer() function lacks both capability and ownership verification. With CVSS 9.1 (Critical) scoring and network-exploitable attack vector requi
This vulnerability is an authentication bypass in the ThimPress LearnPress Sepay Payment plugin for WordPress that allows attackers to abuse authentication mechanisms through alternate paths or channels. The vulnerability affects LearnPress Sepay Payment versions up to and including 4.0.0. An attacker exploiting this flaw could bypass normal authentication controls to gain unauthorized access to the learning platform, potentially accessing student accounts, course content, or administrative functions without valid credentials.
LearnPress, the WordPress learning-management-system plugin from ThimPress, leaves access-controlled functionality reachable without proper authorization in all versions through 4.4.11, letting remote attackers retrieve restricted information from affected sites. Per the assessed vector (AV:N/AC:L/PR:N/UI:N) no credentials or user interaction are needed, but the exposure is bounded: confidentiality impact is LOW while integrity and availability are unaffected, so this is information disclosure rather than account takeover or site compromise. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the priority decision places it in this-month remediation rather than emergency response.
LearnPress through 4.4.11 contains a missing-authorization flaw (CWE-862, CVSS 5.4) that lets an authenticated low-privilege user perform actions outside their intended role, with limited confidentiality and integrity impact and no availability impact. The priority signal is this_month, no public exploit identified at time of analysis, and no CISA KEV entry is present, so this is a moderate rather than urgent issue; a valid account is required, although open LMS self-registration can make obtaining one easier.
LearnPress before 4.4.10 permits authenticated instructors to tamper with other instructors' courses, quizzes, and questions through legacy lp-ajax editor actions. The handlers verify a generic editor nonce but do not perform a per-object ownership or capability check, so an instructor can reuse their own nonce with another object's id to change content, alter quiz answers, or trash questions; confidentiality is not exposed per the assessed vector. The vendor has released version 4.4.10, no public exploit identified at time of analysis, and practical risk is limited to multi-instructor sites where another instructor's content is available to target.
Missing authorization in ThimPress LearnPress through 4.4.10 allows authenticated low-privilege users, such as self-registered students or subscribers, to perform actions they should not be permitted to perform against LMS-managed data. The flaw is medium severity (CVSS 5.4, CWE-862), remotely reachable with low complexity, and requires only a low-privilege authenticated account with no victim user interaction (PR:L/UI:N). No public exploit code or CISA KEV active exploitation is identified at time of analysis.
An authorization bypass in the LearnPress WordPress LMS plugin (all versions through 4.4.10) lets any authenticated user with subscriber-level access or above abuse the plugin's user-search handler as a character-by-character oracle, reconstructing the full site user roster and the complete email address of any account, including administrators. Because LearnPress is a course-selling plugin that commonly permits open registration, the PR:L prerequisite is often trivially satisfied; no user interaction or additional configuration is required. The issue is a bounded confidentiality problem (C:H, no integrity or availability impact) and no public exploit code or CISA KEV entry was identified at time of analysis, though upstream fix work is visible in the plugin's Trac repository.
Stored cross-site scripting in the LearnPress WordPress plugin through version 4.4.9.1 allows authenticated users holding the Instructor role to inject JavaScript into quiz question hint and explanation fields through the update_question AJAX handler, where the payload is persisted and later rendered in the browser session of every student who opens the affected quiz. The root cause is missing sanitization (CWE-79) of those two fields before storage and output, which the upstream commit addresses with Template::sanitize_html_content. Exploitation is limited: it requires an Instructor-level account plus a student actually viewing the quiz, yields only script execution in the student's browser (no server compromise, no privilege escalation), and no public exploit code was identified at time of analysis; this is a genuine but moderate-severity issue rather than a drop-everything priority.
LearnPress WordPress LMS plugin versions through 4.4.7 reflect unsanitized input from the 'orderby' parameter into the DOM, allowing reflected DOM-based cross-site scripting. An unauthenticated attacker can craft a URL that, when a victim clicks or loads it, executes arbitrary script in the victim's browser session; the CVSS vector confirms PR:N and UI:R, with low confidentiality and integrity impact and no availability impact. This is a moderate-severity, interaction-dependent issue, and no public exploit identified at time of analysis.
Missing authorization in the ThimPress LearnPress WordPress plugin through version 4.4.9.1 lets an authenticated low-privilege user perform plugin actions that should require higher privileges, giving a bounded integrity-only impact (CVSS 4.3). Exploitation requires a logged-in account on a site running the affected plugin - anonymous visitors cannot trigger it per the assessed vector (AV:N/AC:L/PR:L/UI:N), and there is no data disclosure or denial-of-service effect. No public exploit identified at time of analysis, and the issue is not in CISA KEV.
Authorization bypass in the ThimPress LearnPress WordPress plugin (versions through 4.4.9) allows unauthenticated remote attackers to read sensitive learner, order, or course data by manipulating a user-controlled key in an insecure direct object reference (IDOR) pattern. Assessed as medium severity (CVSS 5.3) with confidentiality-only impact; no public exploit identified at time of analysis.
Stored cross-site scripting in LearnPress - WordPress LMS Plugin versions through 4.3.9.1 allows authenticated contributors to inject persistent malicious scripts via the 'layout_custom_css' parameter in the Elementor instructor list widget. The payload is written to the database and executes silently in the browser of any subsequent visitor, including administrators, enabling session hijacking, credential theft, or unauthorized actions on behalf of victims. No public exploit or CISA KEV listing has been identified; version 4.4.0 resolves the issue.
Stored cross-site scripting in LearnPress WordPress Plugin before 4.4.6 allows authenticated Instructor-role users to inject persistent JavaScript through quiz question answer title fields, with payloads executing in the browsers of any user who views the affected quiz - including administrators. The unescaped HTML sink means stored payloads persist until patched, making every quiz viewer a potential victim regardless of their privilege level. No public exploit or active exploitation (CISA KEV) is confirmed at time of analysis, but the admin-targeting capability meaningfully elevates practical impact beyond the medium CVSS score.
Broken object-level authorization in the LearnPress WordPress LMS plugin before 4.4.6 allows authenticated Instructor-role users to inject quiz answers into questions owned by other instructors. The answer-insertion endpoint accepts arbitrary question identifiers without verifying ownership, enabling persistent cross-instructor content tampering. No public exploit is identified and the vulnerability is not listed in CISA KEV; a patched version (4.4.6) is available.
SQL injection in the LearnPress WordPress LMS plugin (versions ≤ 4.4.4) allows authenticated administrators to extract arbitrary data from the WordPress database by injecting into the ORDER BY clause of the export_order_csv AJAX action. The flaw exists because the 'orderby' parameter is only partially normalized - only the literal strings 'date' and 'title' are whitelisted - and all other attacker-controlled values are concatenated directly into a raw SQL query inside DataBase::execute() without $wpdb->prepare() or an identifier allowlist. No public exploit has been identified at time of analysis, and the CVSS score of 4.9 (Medium) reflects the high privilege barrier as the primary risk limiter.
Unauthorized option-write in LearnPress (WordPress LMS plugin) versions up to and including 4.4.4 allows authenticated attackers with Editor-level access to overwrite arbitrary WordPress site options with a page ID integer via the learnpress_create_page AJAX endpoint. The LP_Admin_Ajax::create_page() handler validates only the edit_pages capability and a wp_rest nonce - both granted to Editors - but applies no allowlist to the field_name parameter before it is forwarded to update_option(). Exploiting this flaw, an attacker can enable open user registration, corrupt the active plugin list to deny service, or manipulate other administrator-reserved settings. No public exploit has been identified at time of analysis and CISA KEV does not list this CVE.
Stored XSS in the WP Hotel Booking WordPress plugin (all versions through 2.3.2) allows authenticated contributors to inject persistent JavaScript via the 'widget_search' shortcode attribute, exploiting insufficient sanitization before rendering in page templates. The payload is stored in a hidden HTML attribute and executes in a victim's browser when they access the injected page, though exploitation is constrained to browsers where access key interactions can trigger hidden-attribute payloads. No public exploit code has been identified and this CVE is not listed in CISA KEV; real-world risk is lower than the CVSS 6.4 suggests due to the browser-specific prerequisite.
Reflected Cross-Site Scripting in the WP Hotel Booking WordPress plugin (ThimPress) through version 2.3.2 enables unauthenticated network attackers to inject arbitrary JavaScript into hotel booking archive pages via the unsanitized `check_in_date` parameter. When a victim clicks a crafted URL, the payload executes in their browser under the WordPress site's origin — enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim, including against administrator accounts. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV; however, the CVSS scope-change metric (S:C) elevates the base score to 6.1 by reflecting cross-context browser impact.
Payment bypass in WP Hotel Booking (WordPress plugin, all versions ≤2.3.1) allows unauthenticated attackers to mark arbitrary hotel reservations as fully paid without submitting genuine payment. The PayPal IPN handler `web_hook_process_paypal_standard()` accepts an attacker-controlled `test_ipn=1` parameter that silently reroutes IPN validation to PayPal's sandbox environment, where a free sandbox account returns a legitimate 'VERIFIED' response; the handler then promotes any pending booking to completed while skipping critical post-verification checks on `receiver_email`, `mc_currency`, and `txn_id` uniqueness. No public exploit is identified at time of analysis, but the attack requires only a free PayPal sandbox account, making it nearly zero-cost for any motivated attacker.
Reflected cross-site scripting in the WP Hotel Booking WordPress plugin (all versions up to and including 2.3.1) permits unauthenticated remote attackers to inject arbitrary JavaScript via the check_in_date and check_out_date URL parameters across multiple search result and Elementor widget templates. Successful exploitation requires tricking a victim into clicking a crafted link, after which the injected script executes in the victim's browser context - making logged-in administrators particularly high-value targets. No public exploit has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog.
Stored Cross-Site Scripting in the LearnPress WordPress LMS plugin (versions up to and including 4.4.0) allows authenticated contributors to permanently inject arbitrary JavaScript into WordPress pages via the unescaped 'class_wrapper_form' shortcode attribute. The payload persists in the database and executes in the browser of any visitor - including administrators - who loads the affected page, enabling session hijacking, credential harvesting, or privilege escalation through forged admin actions. No CISA KEV listing or public exploit code has been identified at time of analysis, but the Wordfence advisory includes precise code-level references that substantially lower the bar for independent reproduction.
Course enrollment data exposure in LearnPress WordPress LMS plugin (all versions through 4.3.9.1) enables authenticated subscribers to read the course progress and completion records of any instructor or administrator by supplying an arbitrary value to the `userId` REST API parameter. The lazy load controller accepts the caller-supplied key without verifying ownership, bypassing authorization for LP_TEACHER_ROLE and administrator accounts while a partial guard correctly blocks subscriber-to-subscriber cross-access. No public exploit code or active exploitation has been identified at time of analysis, but exploitation requires only a subscriber-level account, making the real-world barrier low on sites with open user registration.
Sensitive information exposure in LearnPress WordPress LMS Plugin (all versions through 4.3.6) allows unauthenticated remote attackers to extract plaintext passwords and unpublished course content via a crafted REST API request. The /wp-json/lp/v1/courses/archive-course endpoint accepts two query parameters - c_status=all and return_type=json - that together bypass a publish-only post_status filter and suppress a safe DISTINCT(ID) field override, triggering an unrestricted SELECT * fallback query against the WordPress posts table. Exposed data includes post_password in plaintext for password-protected courses, and post_content, post_author, and post_name for draft, private, and pending courses. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, though the unauthenticated, low-complexity attack vector makes it trivially scriptable at scale.
PHP Object Injection in the LearnPress - Backup & Migration Tool WordPress plugin (versions ≤ 4.1.4, by ThimPress) allows authenticated administrators to supply maliciously crafted serialized data through the plugin's import functionality, triggering unsafe PHP deserialization. The vulnerability itself carries no direct impact in isolation - exploitation is contingent on a separate plugin or theme installing a usable POP (Property-Oriented Programming) chain on the same site, at which point an attacker can escalate to arbitrary file deletion, sensitive data retrieval, or remote code execution. No public exploit code and no CISA KEV listing have been identified at time of analysis, and the CVSS score of 6.6 (High complexity, High privileges required) reflects the constrained real-world conditions.
Directory traversal in the LearnPress - Backup & Migration Tool plugin for WordPress (all versions through 4.1.4) allows authenticated administrators to read arbitrary files on the underlying server by supplying path traversal sequences via the 'import-user-file' parameter. Exploitation exposes highly sensitive server-side content - including wp-config.php database credentials, private keys, or system files - despite requiring high-privilege access. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV. The CVSS score of 4.9 reflects the high privilege barrier (PR:H), but the C:H confidentiality impact makes successful exploitation consequential.
Missing authorization in the ThimPress Thim Core WordPress plugin (all versions through 2.3.3) allows authenticated low-privileged users to perform actions exceeding their intended permission level due to improperly enforced access control checks. The flaw, classified as CWE-862 (Missing Authorization), results in unauthorized integrity-impacting operations without requiring administrative credentials, as confirmed by the CVSS vector (PR:L/I:L). No public exploit code exists and no active exploitation has been confirmed at time of analysis.
Privilege-bound arbitrary code execution in ThimPress Thim Core (WordPress plugin) versions through 2.3.3 allows authenticated low-privilege users to bypass authorization checks and execute arbitrary code on affected sites, per Patchstack's advisory tagging this as an authentication bypass leading to RCE. The CVSS 8.8 score reflects high impact across confidentiality, integrity, and availability with low attack complexity over the network. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Payment bypass in LearnPress WordPress LMS Plugin (all versions ≤ 4.3.5) allows authenticated subscribers to enroll in any paid course at zero cost by manipulating a REST API parameter. The flaw stems from improper input handling in the add_to_cart() REST API endpoint where PHP's array_merge() permits attacker-supplied values to silently overwrite hardcoded order defaults - specifically the quantity field - causing the order total to resolve to $0 and bypassing all configured payment gateway enforcement. No public exploit code has been identified at time of analysis, and CISA KEV does not list this vulnerability; SSVC and EPSS both signal low current exploitation pressure, though the low-friction exploit path warrants prompt remediation on revenue-generating LMS deployments.
Unauthenticated attackers can bypass authorization controls in FundPress WordPress Donation Plugin versions up to 2.0.8 to arbitrarily modify donation statuses via the donate_action_status() AJAX handler, which lacks nonce verification and capability checks despite being exposed to unauthenticated users. By enumerating sequential donation IDs and sending crafted POST requests, attackers can mark donations as completed, pending, or cancelled, potentially triggering email notifications and corrupting donation records without any user interaction or authentication.
Stored Cross-Site Scripting in LearnPress WordPress LMS Plugin up to version 4.3.3 allows authenticated contributors to inject malicious scripts via the 'skin' attribute of the learn_press_courses shortcode, which lacks proper output escaping. The injected scripts execute whenever any user visits a page containing the malicious shortcode, affecting all sites using vulnerable versions. No evidence of active exploitation exists at time of analysis.
The LearnPress WordPress LMS Plugin contains a missing capability check vulnerability in the delete_question_answer() function that allows authenticated attackers with Subscriber-level privileges to delete quiz answer options without authorization. Affected versions include 4.3.2.8 and earlier; the vulnerability was patched in version 4.3.3. While the CVSS score is moderate (4.3), the attack requires only low-privilege authentication and no user interaction, making it practical for any authenticated site user to exploit.
The Thim Kit for Elementor plugin for WordPress versions up to 1.3.7 allows unauthenticated attackers to access private and draft LearnPress course content through an improperly secured REST API endpoint that accepts arbitrary post status parameters. The vulnerability stems from missing input validation on the 'thim-ekit/archive-course/get-courses' endpoint, enabling information disclosure to any remote attacker without authentication or user interaction. No patch is currently available for this medium-severity flaw affecting WordPress installations using the vulnerable plugin.
Arbitrary file deletion in ThimPress WP Pipes plugin for WordPress (up to version 1.4.3) allows unauthenticated attackers to delete arbitrary files on the server via path traversal. This network-based, high-severity vulnerability (CVSS 8.6) has a low EPSS exploitation probability (0.09%) and is not listed in CISA KEV, with no known public exploit code at time of analysis.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress WP Pipes allows Reflected XSS.4.3. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThimPress WP Pipes allows PHP Local File Inclusion.4.3. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
SQL injection in WP Pipes WordPress plugin versions through 1.4.3 enables unauthenticated remote attackers to extract sensitive database contents and potentially disrupt service availability. The vulnerability carries CVSS 9.3 (Critical) due to network-accessible attack vector with no authentication or user interaction required, though real-world risk is moderated by low EPSS score (0.06%, 19th percentile) indicating minimal observed exploitation activity. Exploitation requires no special conditions beyond accessing the vulnerable WordPress installation, and Patchstack has published detailed vulnerability intelligence.
Path traversal vulnerability in ThimPress WP Pipes that allows unauthenticated remote attackers to access files outside restricted directories, potentially causing denial of service or information disclosure. Versions through 1.4.2 are affected. The vulnerability has a high CVSS score of 8.6 due to network accessibility and no authentication requirements, though the impact is limited to availability rather than confidentiality or integrity.
The LearnPress WordPress plugin before 4.2.7.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The LearnPress WordPress plugin before 4.2.7.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Server-Side Request Forgery (SSRF) vulnerability in ThimPress WP Pipes allows Server Side Request Forgery.4.2. Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable. No vendor patch available.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.2.7.5 due to insufficient input sanitization and output. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The WP Hotel Booking plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hotel_booking_load_order_user AJAX action in all versions up to, and. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The WP Hotel Booking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check when adding rooms in all versions up to, and including, 2.1.5. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The LearnPress WordPress plugin before 4.2.7.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The LearnPress WordPress plugin before 4.2.7.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The WP Pipes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘x1’ parameter in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.7.3 via class-lp-rest-material-controller.php. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 11.0%.
The LearnPress Export Import - WordPress extension for LearnPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'learnpress_import_form_server' parameter in all. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Path Traversal: '.../...//' vulnerability in ThimPress WP Hotel Booking wp-hotel-booking allows PHP Local File Inclusion.2.9. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. No vendor patch available.
The WP Hotel Booking plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the update_review() function in all versions up to, and including, 2.1.2. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Unrestricted File Upload vulnerability could allow attackers to upload malicious files that can be executed on the server.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_fields' parameter of the /wp-json/lp/v1/courses/archive-course REST API endpoint in all versions. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 71.0%.
SQL injection in LearnPress LMS plugin for WordPress (versions ≤ 4.2.7) allows unauthenticated remote attackers to inject arbitrary SQL via the 'c_only_fields' parameter of the /wp-json/learnpress/v1/courses REST endpoint, enabling extraction of sensitive database contents including user credentials and PII. Publicly available exploit code exists, and the EPSS score of 88.05% (99th percentile) indicates very high real-world exploitation likelihood, though the issue is not currently listed in CISA KEV.
The WP Events Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including, 2.1.11 due to insufficient escaping on the user. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in ThimPress LearnPress.2.6.8.2. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'order' parameter in all versions up to, and including, 4.2.6.9.3 due to insufficient. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.2.6.8.2 via the 'render_content_block_template' function. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to unauthenticated bypass to user registration in versions up to, and including, 4.2.6.8.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized user registration due to a missing capability check on the 'register' function in all versions up to, and. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The WP Hotel Booking plugin for WordPress is vulnerable to SQL Injection via the 'room_type' parameter of the /wphb/v1/rooms/search-rooms REST API endpoint in all versions up to, and including, 2.1.0. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 80.4%.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ThimPress Eduma allows Reflected XSS.4.7. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.6.8 due to incorrect implementation of. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 4.2.6.6 due to insufficient. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to bypass to user registration in versions up to, and including, 4.2.6.5. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in the LearnPress LMS plugin for WordPress (versions up to and including 4.2.6.5) allows remote unauthenticated attackers to append arbitrary SQL to a backend query via the term_id parameter, enabling extraction of sensitive database contents such as user credentials and session data. Publicly available exploit code exists and the EPSS score of 77.09% (99th percentile) indicates a very high probability of opportunistic exploitation against exposed WordPress sites running this plugin.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_post_materials' function in versions up to, and. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘layout_html’ parameter in all versions up to, and including, 4.2.6.5 due to. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the _id value in all versions up to, and including, 4.2.6.4 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Course, Lesson, and Quiz title and content in all versions up to, and including,. Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable. No vendor patch available.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.6.3 due to missing validation on a user. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.0.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in ThimPress WP Hotel Booking.0.9.2. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The LearnPress plugin for WordPress is vulnerable to Command Injection in all versions up to, and including, 4.2.5.7 via the get_content function. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and EPSS exploitation probability 91.3%.
The LearnPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order_by’ parameter in all versions up to, and including, 4.2.5.7 due to insufficient escaping on the user. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 82.3%.
The LearnPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.5.7 via the /wp-json/lp/v1/profile/course-tab REST API due to missing. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The WP Hotel Booking WordPress plugin before 2.0.8 does not have proper authorisation when deleting a package, allowing Contributor and above roles to delete posts that do no belong to them. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not escape user input before using it in a SQL statement of a function hooked to. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not ensure that the package to be deleted is a package, allowing any authenticated. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in ThimPress WP Pipes plugin <= 1.4.0 versions. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The WP Hotel Booking plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.10.1. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The LearnPress WordPress plugin before 4.1.7.2 unserialises user input in a REST API endpoint available to unauthenticated users, which could lead to PHP Object Injection when a suitable gadget is. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
The LearnPress WordPress plugin before 4.1.6 does not sanitise and escape the lp-dismiss-notice before outputting it back via the lp_background_single_email AJAX action, leading to a Reflected. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Users of the LearnPress WordPress plugin before 4.1.5 can upload an image as a profile avatar after the registration. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Unauthenticated PHP object injection in the LearnPress WordPress LMS plugin through version 4.4.10 allows attackers to store a crafted serialized object via the checkout-email parameter, which LearnPress later deserializes without an allowed_classes restriction. The CVSS 3.1 score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but practical high-impact exploitation depends on a usable POP gadget chain in LearnPress, WordPress core, or another installed plugin/theme; no public exploit has been identified at time of analysis.
Stored cross-site scripting in the LearnPress WordPress LMS plugin (all versions up to and including 4.4.10) lets attackers plant arbitrary JavaScript that executes in a store administrator's browser when they open the affected order details or invoice export screens in wp-admin. Two injection points exist: the 'quantity' parameter handled by the frontend REST courses controller and the 'order_comments' field captured during checkout; the unauthenticated path depends on the site having guest checkout enabled, while sites with guest checkout disabled still expose both vectors to any Subscriber-level account. CISA KEV does not list this issue and no public exploit identified at time of analysis; exploitation requires the victimized operator to view a poisoned order or invoice page, which keeps it a credible but moderate-priority risk despite a 7.2 CVSS score reflecting scope change into the admin context.
Unauthenticated cross-site scripting in the LearnPress WordPress plugin through version 4.4.9 allows remote attackers to deliver script payloads that execute in a victim's browser once the victim is induced to interact with attacker-controlled input, typically by clicking a crafted link or rendering injected content produced by the plugin. No authentication is required to reach the vulnerable code (PR:N), but exploitation is not zero-click because it depends on victim interaction (UI:R); any publicly reachable WordPress site running a vulnerable LearnPress release is a candidate target in its default configuration. Patchstack reported the issue as a WordPress plugin XSS, no CISA KEV listing or EPSS score was supplied with the intelligence, and there is no public exploit identified at time of analysis.
Unauthenticated attackers can read and download course-material files - including uploaded file paths and external URLs - belonging to lessons in paid or enrollment-required LearnPress courses by exploiting an insecure direct object reference in the plugin's CourseMaterialTemplate::render_material_items() handler (CVE-2026-93882, CVSS 7.5, AV:N/AC:L/PR:N/UI:N). The handler validates authorization against one attacker-supplied identifier (course_id) but fetches material rows using a second, independently attacker-supplied identifier (item_id), with no check that the lesson actually belongs to the authorized course; the call is reachable through the public lp-ajax-handle (load_content_via_ajax) action, which sits on the AbstractAjax no-nonce allowlist and performs no capability check. Exploitation is conditional: at least one course on the target site must have 'No Required Enroll' enabled and own at least one material file, so that a valid course_id exists to satisfy the authorization branch while item_id is pointed at a restricted lesson. Impact is read-only confidentiality loss; no public exploit identified at time of analysis.
Unauthenticated SQL injection in the RealPress WordPress plugin (by ThimPress) affects all versions up to and including 1.1.2, letting remote attackers with no credentials inject crafted SQL through an exposed parameter and read arbitrary data from the site's database. Reported by Patchstack and rated CVSS 9.3, the flaw requires no authentication or user interaction, though there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The primary consequence is disclosure of sensitive database contents such as user records and credential hashes.
Cross-site scripting in the ThimPress "Coaching" WordPress theme (versions <= 3.9.2) lets remote unauthenticated attackers inject arbitrary script that executes in a victim's browser after they interact with a crafted link or page. Reported by Patchstack under CWE-79, the flaw carries a CVSS 3.1 score of 7.1 with a scope change, but there is no public exploit identified at time of analysis and no active-exploitation (KEV) or EPSS signal in the provided data. Impact is primarily session/account compromise of users who view attacker-controlled content within a site running the theme.
Sensitive information exposure in the LearnPress LMS plugin for WordPress (versions up to and including 4.4.1) lets unauthenticated attackers pull correct-answer markers, complete option lists, explanations, and full question content for any quiz on the site through the check_answer logic in its frontend REST API. This exposes graded assessment material for paid courses the attacker never enrolled in or paid for, defeating the plugin's course-access model. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the network-facing, no-authentication nature makes it trivially reproducible against affected sites.
Unauthenticated data deletion in LearnPress WordPress LMS plugin (versions ≤4.3.2.8) allows remote attackers to delete arbitrary quiz answer options without authentication. The plugin exposes wp_rest nonces to unauthenticated visitors in public frontend HTML and uses this nonce as the sole security gate for its AJAX dispatcher, while the delete_question_answer() function lacks both capability and ownership verification. With CVSS 9.1 (Critical) scoring and network-exploitable attack vector requi
This vulnerability is an authentication bypass in the ThimPress LearnPress Sepay Payment plugin for WordPress that allows attackers to abuse authentication mechanisms through alternate paths or channels. The vulnerability affects LearnPress Sepay Payment versions up to and including 4.0.0. An attacker exploiting this flaw could bypass normal authentication controls to gain unauthorized access to the learning platform, potentially accessing student accounts, course content, or administrative functions without valid credentials.
LearnPress, the WordPress learning-management-system plugin from ThimPress, leaves access-controlled functionality reachable without proper authorization in all versions through 4.4.11, letting remote attackers retrieve restricted information from affected sites. Per the assessed vector (AV:N/AC:L/PR:N/UI:N) no credentials or user interaction are needed, but the exposure is bounded: confidentiality impact is LOW while integrity and availability are unaffected, so this is information disclosure rather than account takeover or site compromise. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the priority decision places it in this-month remediation rather than emergency response.
LearnPress through 4.4.11 contains a missing-authorization flaw (CWE-862, CVSS 5.4) that lets an authenticated low-privilege user perform actions outside their intended role, with limited confidentiality and integrity impact and no availability impact. The priority signal is this_month, no public exploit identified at time of analysis, and no CISA KEV entry is present, so this is a moderate rather than urgent issue; a valid account is required, although open LMS self-registration can make obtaining one easier.
LearnPress before 4.4.10 permits authenticated instructors to tamper with other instructors' courses, quizzes, and questions through legacy lp-ajax editor actions. The handlers verify a generic editor nonce but do not perform a per-object ownership or capability check, so an instructor can reuse their own nonce with another object's id to change content, alter quiz answers, or trash questions; confidentiality is not exposed per the assessed vector. The vendor has released version 4.4.10, no public exploit identified at time of analysis, and practical risk is limited to multi-instructor sites where another instructor's content is available to target.
Missing authorization in ThimPress LearnPress through 4.4.10 allows authenticated low-privilege users, such as self-registered students or subscribers, to perform actions they should not be permitted to perform against LMS-managed data. The flaw is medium severity (CVSS 5.4, CWE-862), remotely reachable with low complexity, and requires only a low-privilege authenticated account with no victim user interaction (PR:L/UI:N). No public exploit code or CISA KEV active exploitation is identified at time of analysis.
An authorization bypass in the LearnPress WordPress LMS plugin (all versions through 4.4.10) lets any authenticated user with subscriber-level access or above abuse the plugin's user-search handler as a character-by-character oracle, reconstructing the full site user roster and the complete email address of any account, including administrators. Because LearnPress is a course-selling plugin that commonly permits open registration, the PR:L prerequisite is often trivially satisfied; no user interaction or additional configuration is required. The issue is a bounded confidentiality problem (C:H, no integrity or availability impact) and no public exploit code or CISA KEV entry was identified at time of analysis, though upstream fix work is visible in the plugin's Trac repository.
Stored cross-site scripting in the LearnPress WordPress plugin through version 4.4.9.1 allows authenticated users holding the Instructor role to inject JavaScript into quiz question hint and explanation fields through the update_question AJAX handler, where the payload is persisted and later rendered in the browser session of every student who opens the affected quiz. The root cause is missing sanitization (CWE-79) of those two fields before storage and output, which the upstream commit addresses with Template::sanitize_html_content. Exploitation is limited: it requires an Instructor-level account plus a student actually viewing the quiz, yields only script execution in the student's browser (no server compromise, no privilege escalation), and no public exploit code was identified at time of analysis; this is a genuine but moderate-severity issue rather than a drop-everything priority.
LearnPress WordPress LMS plugin versions through 4.4.7 reflect unsanitized input from the 'orderby' parameter into the DOM, allowing reflected DOM-based cross-site scripting. An unauthenticated attacker can craft a URL that, when a victim clicks or loads it, executes arbitrary script in the victim's browser session; the CVSS vector confirms PR:N and UI:R, with low confidentiality and integrity impact and no availability impact. This is a moderate-severity, interaction-dependent issue, and no public exploit identified at time of analysis.
Missing authorization in the ThimPress LearnPress WordPress plugin through version 4.4.9.1 lets an authenticated low-privilege user perform plugin actions that should require higher privileges, giving a bounded integrity-only impact (CVSS 4.3). Exploitation requires a logged-in account on a site running the affected plugin - anonymous visitors cannot trigger it per the assessed vector (AV:N/AC:L/PR:L/UI:N), and there is no data disclosure or denial-of-service effect. No public exploit identified at time of analysis, and the issue is not in CISA KEV.
Authorization bypass in the ThimPress LearnPress WordPress plugin (versions through 4.4.9) allows unauthenticated remote attackers to read sensitive learner, order, or course data by manipulating a user-controlled key in an insecure direct object reference (IDOR) pattern. Assessed as medium severity (CVSS 5.3) with confidentiality-only impact; no public exploit identified at time of analysis.
Stored cross-site scripting in LearnPress - WordPress LMS Plugin versions through 4.3.9.1 allows authenticated contributors to inject persistent malicious scripts via the 'layout_custom_css' parameter in the Elementor instructor list widget. The payload is written to the database and executes silently in the browser of any subsequent visitor, including administrators, enabling session hijacking, credential theft, or unauthorized actions on behalf of victims. No public exploit or CISA KEV listing has been identified; version 4.4.0 resolves the issue.
Stored cross-site scripting in LearnPress WordPress Plugin before 4.4.6 allows authenticated Instructor-role users to inject persistent JavaScript through quiz question answer title fields, with payloads executing in the browsers of any user who views the affected quiz - including administrators. The unescaped HTML sink means stored payloads persist until patched, making every quiz viewer a potential victim regardless of their privilege level. No public exploit or active exploitation (CISA KEV) is confirmed at time of analysis, but the admin-targeting capability meaningfully elevates practical impact beyond the medium CVSS score.
Broken object-level authorization in the LearnPress WordPress LMS plugin before 4.4.6 allows authenticated Instructor-role users to inject quiz answers into questions owned by other instructors. The answer-insertion endpoint accepts arbitrary question identifiers without verifying ownership, enabling persistent cross-instructor content tampering. No public exploit is identified and the vulnerability is not listed in CISA KEV; a patched version (4.4.6) is available.
SQL injection in the LearnPress WordPress LMS plugin (versions ≤ 4.4.4) allows authenticated administrators to extract arbitrary data from the WordPress database by injecting into the ORDER BY clause of the export_order_csv AJAX action. The flaw exists because the 'orderby' parameter is only partially normalized - only the literal strings 'date' and 'title' are whitelisted - and all other attacker-controlled values are concatenated directly into a raw SQL query inside DataBase::execute() without $wpdb->prepare() or an identifier allowlist. No public exploit has been identified at time of analysis, and the CVSS score of 4.9 (Medium) reflects the high privilege barrier as the primary risk limiter.
Unauthorized option-write in LearnPress (WordPress LMS plugin) versions up to and including 4.4.4 allows authenticated attackers with Editor-level access to overwrite arbitrary WordPress site options with a page ID integer via the learnpress_create_page AJAX endpoint. The LP_Admin_Ajax::create_page() handler validates only the edit_pages capability and a wp_rest nonce - both granted to Editors - but applies no allowlist to the field_name parameter before it is forwarded to update_option(). Exploiting this flaw, an attacker can enable open user registration, corrupt the active plugin list to deny service, or manipulate other administrator-reserved settings. No public exploit has been identified at time of analysis and CISA KEV does not list this CVE.
Stored XSS in the WP Hotel Booking WordPress plugin (all versions through 2.3.2) allows authenticated contributors to inject persistent JavaScript via the 'widget_search' shortcode attribute, exploiting insufficient sanitization before rendering in page templates. The payload is stored in a hidden HTML attribute and executes in a victim's browser when they access the injected page, though exploitation is constrained to browsers where access key interactions can trigger hidden-attribute payloads. No public exploit code has been identified and this CVE is not listed in CISA KEV; real-world risk is lower than the CVSS 6.4 suggests due to the browser-specific prerequisite.
Reflected Cross-Site Scripting in the WP Hotel Booking WordPress plugin (ThimPress) through version 2.3.2 enables unauthenticated network attackers to inject arbitrary JavaScript into hotel booking archive pages via the unsanitized `check_in_date` parameter. When a victim clicks a crafted URL, the payload executes in their browser under the WordPress site's origin — enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim, including against administrator accounts. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV; however, the CVSS scope-change metric (S:C) elevates the base score to 6.1 by reflecting cross-context browser impact.
Payment bypass in WP Hotel Booking (WordPress plugin, all versions ≤2.3.1) allows unauthenticated attackers to mark arbitrary hotel reservations as fully paid without submitting genuine payment. The PayPal IPN handler `web_hook_process_paypal_standard()` accepts an attacker-controlled `test_ipn=1` parameter that silently reroutes IPN validation to PayPal's sandbox environment, where a free sandbox account returns a legitimate 'VERIFIED' response; the handler then promotes any pending booking to completed while skipping critical post-verification checks on `receiver_email`, `mc_currency`, and `txn_id` uniqueness. No public exploit is identified at time of analysis, but the attack requires only a free PayPal sandbox account, making it nearly zero-cost for any motivated attacker.
Reflected cross-site scripting in the WP Hotel Booking WordPress plugin (all versions up to and including 2.3.1) permits unauthenticated remote attackers to inject arbitrary JavaScript via the check_in_date and check_out_date URL parameters across multiple search result and Elementor widget templates. Successful exploitation requires tricking a victim into clicking a crafted link, after which the injected script executes in the victim's browser context - making logged-in administrators particularly high-value targets. No public exploit has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog.
Stored Cross-Site Scripting in the LearnPress WordPress LMS plugin (versions up to and including 4.4.0) allows authenticated contributors to permanently inject arbitrary JavaScript into WordPress pages via the unescaped 'class_wrapper_form' shortcode attribute. The payload persists in the database and executes in the browser of any visitor - including administrators - who loads the affected page, enabling session hijacking, credential harvesting, or privilege escalation through forged admin actions. No CISA KEV listing or public exploit code has been identified at time of analysis, but the Wordfence advisory includes precise code-level references that substantially lower the bar for independent reproduction.
Course enrollment data exposure in LearnPress WordPress LMS plugin (all versions through 4.3.9.1) enables authenticated subscribers to read the course progress and completion records of any instructor or administrator by supplying an arbitrary value to the `userId` REST API parameter. The lazy load controller accepts the caller-supplied key without verifying ownership, bypassing authorization for LP_TEACHER_ROLE and administrator accounts while a partial guard correctly blocks subscriber-to-subscriber cross-access. No public exploit code or active exploitation has been identified at time of analysis, but exploitation requires only a subscriber-level account, making the real-world barrier low on sites with open user registration.
Sensitive information exposure in LearnPress WordPress LMS Plugin (all versions through 4.3.6) allows unauthenticated remote attackers to extract plaintext passwords and unpublished course content via a crafted REST API request. The /wp-json/lp/v1/courses/archive-course endpoint accepts two query parameters - c_status=all and return_type=json - that together bypass a publish-only post_status filter and suppress a safe DISTINCT(ID) field override, triggering an unrestricted SELECT * fallback query against the WordPress posts table. Exposed data includes post_password in plaintext for password-protected courses, and post_content, post_author, and post_name for draft, private, and pending courses. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, though the unauthenticated, low-complexity attack vector makes it trivially scriptable at scale.
PHP Object Injection in the LearnPress - Backup & Migration Tool WordPress plugin (versions ≤ 4.1.4, by ThimPress) allows authenticated administrators to supply maliciously crafted serialized data through the plugin's import functionality, triggering unsafe PHP deserialization. The vulnerability itself carries no direct impact in isolation - exploitation is contingent on a separate plugin or theme installing a usable POP (Property-Oriented Programming) chain on the same site, at which point an attacker can escalate to arbitrary file deletion, sensitive data retrieval, or remote code execution. No public exploit code and no CISA KEV listing have been identified at time of analysis, and the CVSS score of 6.6 (High complexity, High privileges required) reflects the constrained real-world conditions.
Directory traversal in the LearnPress - Backup & Migration Tool plugin for WordPress (all versions through 4.1.4) allows authenticated administrators to read arbitrary files on the underlying server by supplying path traversal sequences via the 'import-user-file' parameter. Exploitation exposes highly sensitive server-side content - including wp-config.php database credentials, private keys, or system files - despite requiring high-privilege access. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV. The CVSS score of 4.9 reflects the high privilege barrier (PR:H), but the C:H confidentiality impact makes successful exploitation consequential.
Missing authorization in the ThimPress Thim Core WordPress plugin (all versions through 2.3.3) allows authenticated low-privileged users to perform actions exceeding their intended permission level due to improperly enforced access control checks. The flaw, classified as CWE-862 (Missing Authorization), results in unauthorized integrity-impacting operations without requiring administrative credentials, as confirmed by the CVSS vector (PR:L/I:L). No public exploit code exists and no active exploitation has been confirmed at time of analysis.
Privilege-bound arbitrary code execution in ThimPress Thim Core (WordPress plugin) versions through 2.3.3 allows authenticated low-privilege users to bypass authorization checks and execute arbitrary code on affected sites, per Patchstack's advisory tagging this as an authentication bypass leading to RCE. The CVSS 8.8 score reflects high impact across confidentiality, integrity, and availability with low attack complexity over the network. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Payment bypass in LearnPress WordPress LMS Plugin (all versions ≤ 4.3.5) allows authenticated subscribers to enroll in any paid course at zero cost by manipulating a REST API parameter. The flaw stems from improper input handling in the add_to_cart() REST API endpoint where PHP's array_merge() permits attacker-supplied values to silently overwrite hardcoded order defaults - specifically the quantity field - causing the order total to resolve to $0 and bypassing all configured payment gateway enforcement. No public exploit code has been identified at time of analysis, and CISA KEV does not list this vulnerability; SSVC and EPSS both signal low current exploitation pressure, though the low-friction exploit path warrants prompt remediation on revenue-generating LMS deployments.
Unauthenticated attackers can bypass authorization controls in FundPress WordPress Donation Plugin versions up to 2.0.8 to arbitrarily modify donation statuses via the donate_action_status() AJAX handler, which lacks nonce verification and capability checks despite being exposed to unauthenticated users. By enumerating sequential donation IDs and sending crafted POST requests, attackers can mark donations as completed, pending, or cancelled, potentially triggering email notifications and corrupting donation records without any user interaction or authentication.
Stored Cross-Site Scripting in LearnPress WordPress LMS Plugin up to version 4.3.3 allows authenticated contributors to inject malicious scripts via the 'skin' attribute of the learn_press_courses shortcode, which lacks proper output escaping. The injected scripts execute whenever any user visits a page containing the malicious shortcode, affecting all sites using vulnerable versions. No evidence of active exploitation exists at time of analysis.
The LearnPress WordPress LMS Plugin contains a missing capability check vulnerability in the delete_question_answer() function that allows authenticated attackers with Subscriber-level privileges to delete quiz answer options without authorization. Affected versions include 4.3.2.8 and earlier; the vulnerability was patched in version 4.3.3. While the CVSS score is moderate (4.3), the attack requires only low-privilege authentication and no user interaction, making it practical for any authenticated site user to exploit.
The Thim Kit for Elementor plugin for WordPress versions up to 1.3.7 allows unauthenticated attackers to access private and draft LearnPress course content through an improperly secured REST API endpoint that accepts arbitrary post status parameters. The vulnerability stems from missing input validation on the 'thim-ekit/archive-course/get-courses' endpoint, enabling information disclosure to any remote attacker without authentication or user interaction. No patch is currently available for this medium-severity flaw affecting WordPress installations using the vulnerable plugin.
Arbitrary file deletion in ThimPress WP Pipes plugin for WordPress (up to version 1.4.3) allows unauthenticated attackers to delete arbitrary files on the server via path traversal. This network-based, high-severity vulnerability (CVSS 8.6) has a low EPSS exploitation probability (0.09%) and is not listed in CISA KEV, with no known public exploit code at time of analysis.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress WP Pipes allows Reflected XSS.4.3. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThimPress WP Pipes allows PHP Local File Inclusion.4.3. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
SQL injection in WP Pipes WordPress plugin versions through 1.4.3 enables unauthenticated remote attackers to extract sensitive database contents and potentially disrupt service availability. The vulnerability carries CVSS 9.3 (Critical) due to network-accessible attack vector with no authentication or user interaction required, though real-world risk is moderated by low EPSS score (0.06%, 19th percentile) indicating minimal observed exploitation activity. Exploitation requires no special conditions beyond accessing the vulnerable WordPress installation, and Patchstack has published detailed vulnerability intelligence.
Path traversal vulnerability in ThimPress WP Pipes that allows unauthenticated remote attackers to access files outside restricted directories, potentially causing denial of service or information disclosure. Versions through 1.4.2 are affected. The vulnerability has a high CVSS score of 8.6 due to network accessibility and no authentication requirements, though the impact is limited to availability rather than confidentiality or integrity.
The LearnPress WordPress plugin before 4.2.7.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The LearnPress WordPress plugin before 4.2.7.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Server-Side Request Forgery (SSRF) vulnerability in ThimPress WP Pipes allows Server Side Request Forgery.4.2. Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable. No vendor patch available.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.2.7.5 due to insufficient input sanitization and output. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The WP Hotel Booking plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hotel_booking_load_order_user AJAX action in all versions up to, and. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The WP Hotel Booking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check when adding rooms in all versions up to, and including, 2.1.5. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The LearnPress WordPress plugin before 4.2.7.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The LearnPress WordPress plugin before 4.2.7.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The WP Pipes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘x1’ parameter in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.7.3 via class-lp-rest-material-controller.php. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 11.0%.
The LearnPress Export Import - WordPress extension for LearnPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'learnpress_import_form_server' parameter in all. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Path Traversal: '.../...//' vulnerability in ThimPress WP Hotel Booking wp-hotel-booking allows PHP Local File Inclusion.2.9. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. No vendor patch available.
The WP Hotel Booking plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the update_review() function in all versions up to, and including, 2.1.2. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Unrestricted File Upload vulnerability could allow attackers to upload malicious files that can be executed on the server.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_fields' parameter of the /wp-json/lp/v1/courses/archive-course REST API endpoint in all versions. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 71.0%.
SQL injection in LearnPress LMS plugin for WordPress (versions ≤ 4.2.7) allows unauthenticated remote attackers to inject arbitrary SQL via the 'c_only_fields' parameter of the /wp-json/learnpress/v1/courses REST endpoint, enabling extraction of sensitive database contents including user credentials and PII. Publicly available exploit code exists, and the EPSS score of 88.05% (99th percentile) indicates very high real-world exploitation likelihood, though the issue is not currently listed in CISA KEV.
The WP Events Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including, 2.1.11 due to insufficient escaping on the user. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in ThimPress LearnPress.2.6.8.2. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'order' parameter in all versions up to, and including, 4.2.6.9.3 due to insufficient. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.2.6.8.2 via the 'render_content_block_template' function. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to unauthenticated bypass to user registration in versions up to, and including, 4.2.6.8.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized user registration due to a missing capability check on the 'register' function in all versions up to, and. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The WP Hotel Booking plugin for WordPress is vulnerable to SQL Injection via the 'room_type' parameter of the /wphb/v1/rooms/search-rooms REST API endpoint in all versions up to, and including, 2.1.0. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 80.4%.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ThimPress Eduma allows Reflected XSS.4.7. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.6.8 due to incorrect implementation of. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 4.2.6.6 due to insufficient. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to bypass to user registration in versions up to, and including, 4.2.6.5. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection in the LearnPress LMS plugin for WordPress (versions up to and including 4.2.6.5) allows remote unauthenticated attackers to append arbitrary SQL to a backend query via the term_id parameter, enabling extraction of sensitive database contents such as user credentials and session data. Publicly available exploit code exists and the EPSS score of 77.09% (99th percentile) indicates a very high probability of opportunistic exploitation against exposed WordPress sites running this plugin.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_post_materials' function in versions up to, and. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘layout_html’ parameter in all versions up to, and including, 4.2.6.5 due to. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the _id value in all versions up to, and including, 4.2.6.4 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Course, Lesson, and Quiz title and content in all versions up to, and including,. Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable. No vendor patch available.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.6.3 due to missing validation on a user. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.0.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in ThimPress WP Hotel Booking.0.9.2. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The LearnPress plugin for WordPress is vulnerable to Command Injection in all versions up to, and including, 4.2.5.7 via the get_content function. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and EPSS exploitation probability 91.3%.
The LearnPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order_by’ parameter in all versions up to, and including, 4.2.5.7 due to insufficient escaping on the user. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 82.3%.
The LearnPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.2.5.7 via the /wp-json/lp/v1/profile/course-tab REST API due to missing. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The WP Hotel Booking WordPress plugin before 2.0.8 does not have proper authorisation when deleting a package, allowing Contributor and above roles to delete posts that do no belong to them. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not escape user input before using it in a SQL statement of a function hooked to. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not ensure that the package to be deleted is a package, allowing any authenticated. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in ThimPress WP Pipes plugin <= 1.4.0 versions. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The WP Hotel Booking plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.10.1. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The LearnPress WordPress plugin before 4.1.7.2 unserialises user input in a REST API endpoint available to unauthenticated users, which could lead to PHP Object Injection when a suitable gadget is. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
The LearnPress WordPress plugin before 4.1.6 does not sanitise and escape the lp-dismiss-notice before outputting it back via the lp_background_single_email AJAX action, leading to a Reflected. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Users of the LearnPress WordPress plugin before 4.1.5 can upload an image as a profile avatar after the registration. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.