CVE-2025-1321 teachPress <= 9.0.7 - Authenticated (Contributor+) SQL Injection

The teachPress plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'tpsearch' shortcode in all versions up to, and including, 9.0.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes...

WordPress teachPress plugin <= 9.0.7 - Authenticated (Contributor+) SQL Injection vulnerability

Authenticated Contributor+ SQL Injection vulnerability discovered by Krzysztof Zając in WordPress Plugin teachPress versions = 9.0.7...

CVE-2023-52129 WordPress teachPress Plugin <= 9.0.4 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Michael Winkler teachPress.This issue affects teachPress: from n/a through 9.0.4...

CVE-2023-48755 WordPress teachPress Plugin <= 9.0.4 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Michael Winkler teachPress.This issue affects teachPress: from n/a through 9.0.4...

teachPress < 9.0.6 - Cross-Site Request Forgery via delete_database()

Description The teachPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 9.0.5. This is due to missing or incorrect nonce validation on the deletedatabase function. This makes it possible for unauthenticated attackers to clear the database...

CVE-2023-36501

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Michael Winkler teachPress plugin = 9.0.2 versions...

Cross site scripting

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Michael Winkler teachPress plugin = 9.0.2 versions...

CVE-2023-36501

The CVE-2023-36501 entry concerns the WordPress teachPress plugin (affected versions ≤ 9.0.2) and describes an unauthenticated, reflected Cross-Site Scripting (XSS) vulnerability via meta_field_id and cite_id. The issue is confirmed in multiple sources (Patchstack and CVE/NVD references) with a r...

PT-2023-25596 · WordPress · Teachpress

Name of the Vulnerable Software and Affected Versions: teachPress plugin versions = 9.0.2 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This type of vulnerability allows an attacker to inject malicious scripts into a website, potentially leading...

CVE-2023-22704

Reflected Cross-Site Scripting XSS vulnerability in Michael Winkler teachPress plugin = 8.1.8 versions...

CVE-2023-22704

Reflected Cross-Site Scripting XSS vulnerability in Michael Winkler teachPress plugin = 8.1.8 versions...

CVE-2023-22704 WordPress teachPress Plugin <= 8.1.8 is vulnerable to Cross Site Scripting (XSS)

Reflected Cross-Site Scripting XSS vulnerability in Michael Winkler teachPress plugin = 8.1.8 versions...

CVE-2023-22704

The CVE-2023-22704 entry concerns the teachPress WordPress plugin, affected versions ≤ 8.1.8. The underlying issue is a Reflected Cross-Site Scripting (XSS) vulnerability, caused by the plugin not sanitizing/escaping inputs (notably the tab parameter) before output. Exploitation is described as p...