Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

9 records

Vendor: ThimPress Component: Wp Pipes Clear all filters
TI-2025-37593 CVE-2025-60227 · GHSA-8r69-vq96-g59q

WordPress WP Pipes plugin <= 1.4.3 - Arbitrary File Deletion vulnerability

Priority MEDIUM 44

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThimPress WP Pipes wp-pipes allows Path Traversal.This issue affects WP Pipes: from n/a through <= 1.4.3.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00509 Published 2025-10-22 No fix listed CWE-22
TI-2025-20922 CVE-2025-28979 · GHSA-qmvw-264f-4qhw

WordPress WP Pipes <= 1.4.3 - Local File Inclusion Vulnerability

Priority MEDIUM 43

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThimPress WP Pipes allows PHP Local File Inclusion.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00518 Published 2025-08-14 No fix listed CWE-98
TI-2025-20925 CVE-2025-28982 · GHSA-q792-q3mv-8frw

WordPress WP Pipes plugin <= 1.4.3 - SQL Injection Vulnerability

Priority MEDIUM 49

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ThimPress WP Pipes allows SQL Injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00479 Published 2025-07-16 No fix listed CWE-89
TI-2024-11393 CVE-2024-12283 · GHSA-3mq8-695h-7r35

WP Pipes <= 1.4.1 - Reflected Cross-Site Scripting via x1 Parameter

Priority LOW 27

The WP Pipes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘x1’ parameter in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0037 Published 2024-12-11 No fix listed CWE-79