Themeum
92 CVEs across 21 Themeum products. Browse Themeum vulnerabilities, severities, and proof-of-concept exploits.
Themeum products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-16974 | Medium | 6.4 | 2026-08-11 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post_meta Shortcode i… |
CVE-2026-15601 | Medium | 4.9 | 2026-08-01 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Path Traversal (Zip Slip) in all versions up to, and incl… |
CVE-2026-15444 | Medium | 4.9 | 2026-07-28 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the 'coupon_code' parameter in all version… |
CVE-2026-65436 | Medium | 6.8 | 2026-07-27 | Editor Arbitrary File Deletion in Kirki <= 6.0.13 versions. |
CVE-2026-13464 | Medium | 5.3 | 2026-07-24 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, a… |
CVE-2026-65531 | Medium | 4.8 | 2026-07-23 | Unauthenticated Broken Access Control in Qubely <= 1.8.14 versions. |
CVE-2026-1372 | Medium | 4.3 | 2026-07-21 | The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.0.0 This is due to missing c… |
CVE-2026-15457 | Medium | 4.9 | 2026-07-17 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including… |
CVE-2026-15022 | Medium | 6.5 | 2026-07-16 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via Stored Quiz Answer Array in all versions u… |
CVE-2026-57727 | High | 7.5 | 2026-07-13 | Missing Authorization vulnerability in Themeum Kirki kirki allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kirki: fr… |
CVE-2026-57726 | Critical | 9.3 | 2026-07-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Kirki kirki allows Blind SQL Injection.This issue… |
CVE-2026-57725 | High | 7.1 | 2026-07-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Kirki kirki allows Stored XSS.This issue affects… |
CVE-2026-57724 | Critical | 9.8 | 2026-07-13 | Deserialization of Untrusted Data vulnerability in Themeum Kirki kirki allows Object Injection.This issue affects Kirki: from n/a through <= 6.0.12. |
CVE-2026-57694 | Medium | 6.5 | 2026-07-13 | Authorization Bypass Through User-Controlled Key vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2026-57680 | Medium | 6.5 | 2026-07-02 | Unauthenticated Insecure Direct Object References (IDOR) in Kirki <= 6.0.11 versions. |
CVE-2026-12472 | Medium | 5.3 | 2026-07-02 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including… |
CVE-2026-12122 | Medium | 5.3 | 2026-07-02 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and… |
CVE-2026-13443 | Medium | 6.4 | 2026-07-01 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Lesson Attachment Title in all versi… |
CVE-2026-57627 | Medium | 4.9 | 2026-06-26 | Subscriber Server Side Request Forgery (SSRF) in Kirki <= 6.0.11 versions. |
CVE-2026-10736 | Medium | 4.9 | 2026-06-18 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the 'data' parameter in all versions up to… |
CVE-2026-22332 | Critical | 9.3 | 2026-06-17 | Unauthenticated SQL Injection in Tutor LMS Pro <= 3.9.6 versions. |
CVE-2026-22330 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Right Way <= 4.0 versions. |
CVE-2026-22329 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Skillate <= 1.2.10 versions. |
CVE-2026-40743 | Medium | 6.5 | 2026-06-15 | Unauthenticated Broken Access Control in Tutor LMS <= 3.9.7 versions. |
CVE-2026-8206 | Critical | 9.8 | 2026-06-02 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions… |
CVE-2026-8096 | Medium | 6.5 | 2026-05-19 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including… |
CVE-2026-8073 | High | 7.5 | 2026-05-19 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path val… |
CVE-2026-6965 | Medium | 5.3 | 2026-05-13 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 3.9… |
CVE-2026-6080 | Medium | 6.5 | 2026-04-17 | The Tutor LMS plugin for WordPress is vulnerable to SQL Injection in versions up to and including 3.9.8. This is due to insufficient escaping on the 'date' par… |
CVE-2026-5502 | Medium | 5.3 | 2026-04-17 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized course content manipulation in versions up to and inclu… |
CVE-2026-40740 | Medium | 5.4 | 2026-04-15 | Missing Authorization vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor… |
CVE-2026-3371 | Medium | 4.3 | 2026-04-11 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and includin… |
CVE-2026-3358 | Medium | 5.4 | 2026-04-11 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized private course enrollment in all versions up to, and in… |
CVE-2026-3360 | High | 7.5 | 2026-04-10 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to an Insecure Direct Object Reference in all versions up to, and inclu… |
CVE-2026-39638 | Medium | 5.9 | 2026-04-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Qubely qubely allows Stored XSS.This issue affect… |
CVE-2026-25406 | High | 8.1 | 2026-03-25 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Themeum Tutor LMS Pro tutor-pro allows Authentication Abuse.This issue affects Tutor… |
CVE-2025-32223 | Medium | 6.5 | 2026-03-19 | Authorization Bypass Through User-Controlled Key vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2026-0953 | Critical | 9.8 | 2026-03-10 | The Tutor LMS Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 3.9.5 via the Social Login addon. This is d… |
CVE-2026-23799 | Medium | 6.5 | 2026-03-05 | Missing Authorization vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor… |
CVE-2025-13673 | High | 7.5 | 2026-02-28 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to SQL Injection via the 'coupon_code' parameter in all versions up to… |
CVE-2026-1375 | High | 8.1 | 2026-02-03 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object References (IDOR) in all versions up to, and… |
CVE-2026-1371 | Medium | 5.3 | 2026-02-03 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including… |
CVE-2026-24584 | Medium | 5.9 | 2026-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS BunnyNet Integration tutor-lms-bunnynet… |
CVE-2025-47555 | Low | 3.8 | 2026-01-22 | Authorization Bypass Through User-Controlled Key vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2026-0548 | Medium | 5.4 | 2026-01-20 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized attachment deletion due to a missing capability check o… |
CVE-2025-13935 | Medium | 4.3 | 2026-01-09 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized course completion in all versions up to, and including… |
CVE-2025-13934 | Medium | 4.3 | 2026-01-09 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized course enrollment in all versions up to, and including… |
CVE-2025-13628 | Medium | 4.3 | 2026-01-09 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification and deletion of data due to a missing capa… |
CVE-2025-13679 | Medium | 6.5 | 2026-01-08 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the… |
CVE-2025-63042 | Medium | 6.5 | 2025-12-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS Elementor Addons tutor-lms-elementor-ad… |
CVE-2025-6680 | Medium | 4.3 | 2025-10-25 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including… |
CVE-2025-6639 | Medium | 5.4 | 2025-10-25 | The Tutor LMS Pro – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and incl… |
CVE-2025-11564 | Medium | 5.3 | 2025-10-25 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check… |
CVE-2025-58663 | Medium | 4.3 | 2025-09-22 | Missing Authorization vulnerability in Themeum Qubely qubely allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Qubely… |
CVE-2025-58249 | Medium | 4.3 | 2025-09-22 | Insertion of Sensitive Information Into Sent Data vulnerability in Themeum Qubely qubely allows Retrieve Embedded Sensitive Data.This issue affects Qubely: fro… |
CVE-2025-58993 | High | 7.6 | 2025-09-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS tutor allows SQL Injection.This issue a… |
CVE-2025-6184 | High | 8.8 | 2025-08-13 | The Tutor LMS Pro – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter used in the g… |
CVE-2025-5835 | High | 8.8 | 2025-07-25 | The Droip plugin for WordPress is vulnerable to unauthorized modification and access of data due to a missing capability check on the droip_post_apis() functio… |
CVE-2025-5831 | High | 8.8 | 2025-07-25 | The Droip plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the make_google_font_offline() function in all ve… |
CVE-2025-32230 | Medium | 4.3 | 2025-04-10 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Themeum Tutor LMS tutor.This issue affects Tutor LMS: from n/a t… |
CVE-2025-31892 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum WP Crowdfunding wp-crowdfunding allows Stored XSS… |
CVE-2025-1508 | Medium | 5.3 | 2025-03-12 | The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the download_data action in all vers… |
CVE-2024-13228 | Medium | 4.3 | 2025-03-11 | The Qubely – Advanced Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.13 via th… |
CVE-2025-26767 | Medium | 6.5 | 2025-02-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Qubely qubely allows Stored XSS.This issue affect… |
CVE-2024-9601 | Medium | 6.5 | 2025-02-14 | The Qubely – Advanced Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ and 'UniqueID' parameter in all versi… |
CVE-2024-54282 | High | 7.2 | 2024-12-13 | Deserialization of Untrusted Data vulnerability in Themeum WP Mega Menu wp-megamenu allows Object Injection.This issue affects WP Mega Menu: from n/a through <… |
CVE-2023-41870 | Medium | 4.3 | 2024-12-13 | Missing Authorization vulnerability in Themeum WP Crowdfunding allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Cr… |
CVE-2024-11911 | Medium | 4.3 | 2024-12-13 | The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the install_woocommerce_plugin(… |
CVE-2024-11910 | Medium | 6.4 | 2024-12-13 | The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wp-crowdfunding/search block in all versions up to, and including… |
CVE-2024-53816 | Medium | 4.3 | 2024-12-09 | Missing Authorization vulnerability in Themeum Tutor LMS Elementor Addons tutor-lms-elementor-addons.This issue affects Tutor LMS Elementor Addons: from n/a th… |
CVE-2024-10400 | High | 7.5 | 2024-11-21 | The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via the ‘rating_filter’ parameter in all versions up to, and including, 2.7.6 due to insuffic… |
CVE-2024-10393 | Medium | 5.3 | 2024-11-21 | The Tutor LMS plugin for WordPress is vulnerable to bypass to user registration in versions up to, and including, 2.7.6. This is due to a missing check for the… |
CVE-2024-10897 | Medium | 4.3 | 2024-11-15 | The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the install_etlms_de… |
CVE-2024-43937 | Medium | 6.4 | 2024-11-01 | Missing Authorization vulnerability in Themeum WP Crowdfunding allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Cr… |
CVE-2024-43142 | Medium | 4.3 | 2024-11-01 | Missing Authorization vulnerability in Themeum Tutor LMS allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS… |
CVE-2024-10117 | Medium | 6.4 | 2024-10-26 | The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpcf_donate shortcode in all versions up to, and includi… |
CVE-2023-2919 | Medium | 4.3 | 2024-09-10 | The Tutor LMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.4. This is due to missing or incorrect non… |
CVE-2024-5784 | High | 7.1 | 2024-08-30 | The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized administrative actions execution due to a missing capability checks on multiple functions… |
CVE-2024-43955 | Critical | 10.0 | 2024-08-29 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themeum Droip allows File Manipulation.This issue affects Droip… |
CVE-2024-43954 | Medium | 6.3 | 2024-08-29 | Incorrect Authorization vulnerability in Themeum Droip allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Droip: from n/a throu… |
CVE-2024-39645 | Medium | 5.4 | 2024-08-26 | Cross-Site Request Forgery (CSRF) vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a through 2.7.2. |
CVE-2024-5576 | Medium | 6.4 | 2024-08-20 | The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'course_carousel_skin' attribute within the plugin's C… |
CVE-2024-43282 | High | 7.6 | 2024-08-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a… |
CVE-2024-43231 | Medium | 6.5 | 2024-08-12 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themeum Tutor LMS allows Stored XSS.This issue aff… |
CVE-2024-1804 | Medium | 4.3 | 2024-07-27 | The Tutor LMS – Migration Tool plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tutor_import_fr… |
CVE-2024-1798 | Medium | 5.3 | 2024-07-27 | The Tutor LMS – Migration Tool plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the tutor_lp_export_xml f… |
CVE-2024-37947 | Medium | 5.9 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themeum Tutor LMS allows Stored XSS.This issue aff… |
CVE-2024-37266 | Medium | 4.9 | 2024-07-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themeum Tutor LMS allows Path Traversal.This issue affects Tuto… |
CVE-2024-37256 | High | 7.6 | 2024-07-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a… |
CVE-2023-25799 | High | 8.3 | 2024-06-11 | Missing Authorization vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a through 2.1.8. |
CVE-2024-5438 | Medium | 4.3 | 2024-06-07 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and includin… |
CVE-2024-4902 | High | 7.2 | 2024-06-07 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the ‘course_id’ parameter in all versio… |
CVE-2024-4352 | High | 8.8 | 2024-05-16 | The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on th… |
CVE-2024-4351 | High | 8.8 | 2024-05-16 | The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on th… |
CVE-2024-4222 | High | 7.3 | 2024-05-16 | The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on mu… |
CVE-2024-4223 | Critical | 9.8 | 2024-05-16 | The Tutor LMS plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on multip… |
CVE-2024-4318 | High | 8.8 | 2024-05-16 | The Tutor LMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘question_id’ parameter in versions up to, and including, 2.7.0 due to ins… |
CVE-2024-4279 | Medium | 6.5 | 2024-05-16 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference to Arbitrary Course Deletion in ver… |
CVE-2024-3553 | Medium | 6.5 | 2024-05-02 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check… |
CVE-2024-3994 | Medium | 5.4 | 2024-04-25 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tutor_instructor_list'… |