WP
Product
WP Pipes
9
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 2Medium 4Low 0
Watch
Add WP Pipes to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-28979 | 9.8 | Aug 14 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThimPress WP Pipes allows PHP Local File Inclusion Affected: through 1.4.3 |
| CVE-2025-28982 | 9.8 | Jul 16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ThimPress WP Pipes allows SQL Injection Affected: through 1.4.3 |
| CVE-2025-48267 | 9.1 | Jun 9 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThimPress WP Pipes allows Path Traversal Affected: before 1.4.3 |
| CVE-2025-60227 | 8.6 | Oct 22 | WordPress WP Pipes plugin <= 1.4.3 - Arbitrary File Deletion vulnerability Affected: through 1.4.3 |
| CVE-2022-45355 | 7.2 | Mar 29 | Auth. (admin+) SQL Injection (SQLi) vulnerability in ThimPress WP Pipes plugin <= 1.33 versions Affected: through 1.33 |
| CVE-2025-47664 | 6.5 | May 7 | Server-Side Request Forgery (SSRF) vulnerability in ThimPress WP Pipes allows Server Side Request Forgery Affected: through 1.4.3 |
| CVE-2023-40009 | 6.5 | Oct 3 | Cross-Site Request Forgery (CSRF) vulnerability in ThimPress WP Pipes plugin <= 1.4.0 versions Affected: through 1.4.0 |
| CVE-2025-28977 | 6.1 | Aug 20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress WP Pipes allows Reflected XSS Affected: through 1.4.3 |
| CVE-2024-12283 | 6.1 | Dec 11 | The WP Pipes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘x1’ parameter in all versions up to, and including, 1.4.1 due to insufficient input… Affected: before 1.4.2 |
Showing 9