ThimPress

Records156All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical23CVSS 9.0–10.0

CVSS high37CVSS 7.0–8.9

Exploited now

ThimPress records in CISA KEV

No ThimPress vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Learnpress 45 records HIGH Wp Hotel Booking 12 records HIGH Wp Pipes 9 records MEDIUM Eduma 1 record LOW Learnpress Export Import 1 record LOW Wp Events Manager 1 record MEDIUM

Records

9 records in Wp Pipes · all components

TI-2025-20925 CVE-2025-28982 · GHSA-q792-q3mv-8frw

WordPress WP Pipes plugin <= 1.4.3 - SQL Injection Vulnerability

MEDIUM 49

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ThimPress WP Pipes allows SQL Injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00479 Published 2025-07-16 No fix listed CWE-89

TI-2025-30593 CVE-2025-48267 · GHSA-cm69-44fh-7hgm

WordPress WP Pipes plugin <= 1.4.2 - Arbitrary File Deletion Vulnerability

MEDIUM 46

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThimPress WP Pipes allows Path Traversal.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00492 Published 2025-06-09 No fix listed CWE-22

TI-2025-37593 CVE-2025-60227 · GHSA-8r69-vq96-g59q

WordPress WP Pipes plugin <= 1.4.3 - Arbitrary File Deletion vulnerability

MEDIUM 44

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThimPress WP Pipes wp-pipes allows Path Traversal.This issue affects WP Pipes: from n/a through <= 1.4.3.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00509 Published 2025-10-22 No fix listed CWE-22

TI-2025-20922 CVE-2025-28979 · GHSA-qmvw-264f-4qhw

WordPress WP Pipes <= 1.4.3 - Local File Inclusion Vulnerability

MEDIUM 43

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThimPress WP Pipes allows PHP Local File Inclusion.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00518 Published 2025-08-14 No fix listed CWE-98

TI-2022-22321 CVE-2022-45355 · GHSA-6gg3-r538-67r7

WordPress WP Pipes Plugin <= 1.33 is vulnerable to SQL Injection (SQLi)

LOW 37

Auth. (admin+) SQL Injection (SQLi) vulnerability in ThimPress WP Pipes plugin <= 1.33 versions.

CVSS 3.1HIGH 8.2 Network High privileges No interaction EPSS 0.00628 Published 2023-03-29 No fix listed CWE-89

TI-2025-20920 CVE-2025-28977 · GHSA-3qxj-j9pp-55cr

WordPress WP Pipes Plugin <= 1.4.3 - Cross Site Scripting (XSS) Vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress WP Pipes allows Reflected XSS.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00237 Published 2025-08-20 No fix listed CWE-79

TI-2025-30161 CVE-2025-47664 · GHSA-3px8-2p4q-xpwm

WordPress WP Pipes <= 1.4.2 - Server Side Request Forgery (SSRF) Vulnerability

LOW 28

Server-Side Request Forgery (SSRF) vulnerability in ThimPress WP Pipes allows Server Side Request Forgery.

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.00228 Published 2025-05-07 No fix listed CWE-918

TI-2023-20900 CVE-2023-40009 · GHSA-2f8j-g2jm-9xj8

WordPress WP Pipes Plugin <= 1.4.0 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 28

Cross-Site Request Forgery (CSRF) vulnerability in ThimPress WP Pipes plugin <= 1.4.0 versions.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00234 Published 2023-10-03 No fix listed CWE-352

TI-2024-11393 CVE-2024-12283 · GHSA-3mq8-695h-7r35

WP Pipes <= 1.4.1 - Reflected Cross-Site Scripting via x1 Parameter

LOW 27

The WP Pipes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘x1’ parameter in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0037 Published 2024-12-11 No fix listed CWE-79

Open these records in search →