Themeum
Page 2 of 2 — Themeum CVEs from a corpus of 152, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-37947 | Medium | 5.9 | 2024-07-20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themeum Tutor LMS allows Stored XSS.This issue aff… |
CVE-2024-37266 | Medium | 4.9 | 2024-07-09 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themeum Tutor LMS allows Path Traversal.This issue affects Tuto… |
CVE-2024-37256 | High | 7.6 | 2024-07-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a… |
CVE-2023-25799 | High | 8.3 | 2024-06-11 | Missing Authorization vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a through 2.1.8. |
CVE-2024-5438 | Medium | 4.3 | 2024-06-07 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and includin… |
CVE-2024-4902 | High | 7.2 | 2024-06-07 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the ‘course_id’ parameter in all versio… |
CVE-2024-4352 | High | 8.8 | 2024-05-16 | The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on th… |
CVE-2024-4351 | High | 8.8 | 2024-05-16 | The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on th… |
CVE-2024-4222 | High | 7.3 | 2024-05-16 | The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on mu… |
CVE-2024-4223 | Critical | 9.8 | 2024-05-16 | The Tutor LMS plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on multip… |
CVE-2024-4318 | High | 8.8 | 2024-05-16 | The Tutor LMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘question_id’ parameter in versions up to, and including, 2.7.0 due to ins… |
CVE-2024-4279 | Medium | 6.5 | 2024-05-16 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference to Arbitrary Course Deletion in ver… |
CVE-2024-3553 | Medium | 6.5 | 2024-05-02 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check… |
CVE-2024-3994 | Medium | 5.4 | 2024-04-25 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tutor_instructor_list'… |
CVE-2024-29913 | Medium | 6.5 | 2024-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS Elementor Addons allows Stored XSS.This… |
CVE-2024-1503 | Medium | 4.3 | 2024-03-21 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6… |
CVE-2024-1502 | Medium | 5.4 | 2024-03-21 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the t… |
CVE-2024-1751 | High | 8.8 | 2024-03-13 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the question_id parameter in all versio… |
CVE-2024-1133 | Medium | 4.3 | 2024-02-29 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized access of restricted Q&A content due to a missing capab… |
CVE-2024-1128 | Medium | 5.4 | 2024-02-29 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 2.6.0. This is… |
CVE-2023-0376 | Medium | 5.4 | 2024-01-16 | The Qubely WordPress plugin before 1.8.5 does not validate and escape some of its block options before outputting them back in a page/post where the block is e… |
CVE-2023-6163 | Medium | 4.8 | 2024-01-15 | The WP Crowdfunding WordPress plugin before 2.1.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2023-6161 | Medium | 6.1 | 2024-01-08 | The WP Crowdfunding WordPress plugin before 2.1.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-… |
CVE-2023-50859 | Medium | 6.5 | 2023-12-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum WP Crowdfunding allows Stored XSS.This issue affe… |
CVE-2023-49829 | Medium | 5.9 | 2023-12-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS – eLearning and online course solution… |
CVE-2023-5757 | Medium | 4.8 | 2023-12-11 | The WP Crowdfunding WordPress plugin before 2.1.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to pe… |
CVE-2023-47532 | Medium | 5.8 | 2023-11-14 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Themeum WP Crowdfunding plugin <= 2.1.6 versions. |
CVE-2023-25990 | High | 7.1 | 2023-11-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS allows SQL Injection.This issue affects… |
CVE-2023-25800 | High | 8.1 | 2023-11-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS allows SQL Injection.This issue affects… |
CVE-2023-25700 | High | 8.2 | 2023-11-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS allows SQL Injection.This issue affects… |
CVE-2023-4805 | Medium | 5.4 | 2023-10-16 | The Tutor LMS WordPress plugin before 2.3.0 does not sanitise and escape some of its settings, which could allow users such as subscriber to perform Stored Cro… |
CVE-2021-24916 | High | 7.5 | 2023-08-07 | The Qubely WordPress plugin before 1.8.6 allows unauthenticated user to send arbitrary e-mails to arbitrary addresses via the qubely_send_form_data AJAX action. |
CVE-2023-3133 | High | 7.5 | 2023-07-04 | The Tutor LMS WordPress plugin before 2.2.1 does not implement adequate permission checks for REST API endpoints, allowing unauthenticated attackers to access… |
CVE-2023-0236 | Medium | 6.1 | 2023-02-06 | The Tutor LMS WordPress plugin before 2.0.10 does not sanitise and escape the reset_key and user_id parameters before outputting then back in attributes, leadi… |
CVE-2022-3830 | Medium | 4.8 | 2022-12-05 | The WP Page Builder WordPress plugin through 1.2.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2022-40963 | Medium | 4.8 | 2022-11-18 | Multiple Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerabilities in WP Page Builder plugin <= 1.2.6 on WordPress. |
CVE-2022-2563 | Medium | 4.8 | 2022-10-17 | The Tutor LMS WordPress plugin before 2.0.10 does not escape some course parameters, which could allow high privilege users such as admin to perform Stored Cro… |
CVE-2021-25017 | Medium | 6.1 | 2022-01-24 | The Tutor LMS WordPress plugin before 1.9.12 does not escape the search parameter before outputting it back in an attribute in an admin page, leading to a Refl… |
CVE-2021-25013 | Medium | 6.5 | 2022-01-24 | The Qubely WordPress plugin before 1.7.8 does not have authorisation and CSRF check on the qubely_delete_saved_block AJAX action, and does not ensure that the… |
CVE-2021-24873 | Medium | 6.1 | 2021-11-23 | The Tutor LMS WordPress plugin before 1.9.11 does not sanitise and escape user input before outputting back in attributes in the Student Registration page, lea… |
CVE-2021-24740 | Medium | 4.8 | 2021-10-18 | The Tutor LMS WordPress plugin before 1.9.9 does not escape some of its settings before outputting them in attributes, which could allow high privilege users t… |
CVE-2021-24455 | Medium | 5.4 | 2021-08-02 | The Tutor LMS – eLearning and online course solution WordPress plugin before 1.9.2 did not escape the Summary field of Announcements (when outputting it in an… |
CVE-2021-24242 | Low | 3.8 | 2021-04-22 | The Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.8 is affected by a local file inclusion vulnerability through the maliciously… |
CVE-2021-24208 | Medium | 5.4 | 2021-04-05 | The editor of the WP Page Builder WordPress plugin before 1.2.4 allows lower-privileged users to insert unfiltered HTML, including JavaScript, into pages via t… |
CVE-2021-24207 | Medium | 4.3 | 2021-04-05 | By default, the WP Page Builder WordPress plugin before 1.2.4 allows subscriber-level users to edit and make changes to any and all posts pages - user roles mu… |
CVE-2021-24186 | Medium | 6.5 | 2021-04-05 | The tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vu… |
CVE-2021-24185 | Medium | 6.5 | 2021-04-05 | The tutor_place_rating AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vulnerable to blind and time bas… |
CVE-2021-24184 | High | 8.8 | 2021-04-05 | Several AJAX endpoints in the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 were unprotected, allowing students to modify cour… |
CVE-2021-24183 | Medium | 6.5 | 2021-04-05 | The tutor_quiz_builder_get_question_form AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to… |
CVE-2021-24182 | Medium | 6.5 | 2021-04-05 | The tutor_quiz_builder_get_answers_by_question AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerab… |
CVE-2021-24181 | Medium | 6.5 | 2021-04-05 | The tutor_mark_answer_as_correct AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vulnerable to blind an… |
CVE-2020-8615 | Medium | 6.5 | 2020-02-04 | A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and performing other ma… |