Themeum vulnerabilities

Products

• Tutor Lms – Elearning And Online Course Solution 58
• Tutor Lms 49
• Tutor Lms 39
• Kirki 27
• Kirki – Freeform Page Builder, Website Builder & Customizer 19
• Wp Crowdfunding 13
• Wp Crowdfunding 11
• Qubely 10
• Tutor Lms Pro 9
• Tutor Lms Elementor Addons 6
• Droip 4
• Tutor Lms Elementor Addons 4
• Wp Page Builder 4
• Qubely – Advanced Gutenberg Blocks 3
• Tutor Lms – Migration Tool 2
• Tutor Lms - Migration Tool 2
• Wp Mega Menu 2

Newest

• themeum kirki Kirki WordPress Plugin < 6.2.5 reCAPTCHA Bypass via Missing Token CVE-2026-112348 6.9 MediumOctober 30, 2026
• themeum kirki Kirki WordPress Plugin < 6.4.1 Broken Object-Level Access Control via Page API CVE-2026-112347 7.2 HighOctober 30, 2026
• themeum wp crowdfunding WordPress WP Crowdfunding plugin <= 2.2.2 - Sensitive Data Exposure vulnerability CVE-2026-118083 7.5 HighOctober 29, 2026
• themeum wp crowdfunding WordPress WP Crowdfunding plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability CVE-2026-42692 7.1 HighOctober 29, 2026
• themeum kirki WordPress Kirki plugin <= 6.4.0 - Content Injection vulnerability CVE-2026-42694 4.3 MediumOctober 29, 2026
• themeum kirki – freeform page builder, website builder & customizer Kirki <= 6.2.5 - Authenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover via 'get-single-symbol' AJAX Endpoint CVE-2026-75891 8.8 HighOctober 27, 2026
• themeum tutor lms WordPress Tutor LMS plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerability CVE-2026-111407 6.5 MediumOctober 19, 2026
• themeum tutor lms – elearning and online course solution Tutor LMS <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover via 'ID' Parameter CVE-2026-92715 4.3 MediumOctober 17, 2026
• themeum kirki – freeform page builder, website builder & customizer Kirki <= 6.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via 'context' Parameter CVE-2026-107762 7.5 HighOctober 17, 2026
• themeum kirki – freeform page builder, website builder & customizer Kirki <= 6.3.2 - Authenticated (Administrator+) PHP Object Injection via Deserialization of Untrusted Input via ZIP Template Import CVE-2026-104734 7.2 HighOctober 17, 2026
• themeum tutor lms – elearning and online course solution Tutor LMS <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name Parameter CVE-2026-93681 6.4 MediumOctober 16, 2026
• themeum tutor lms – elearning and online course solution Tutor LMS <= 4.0.8 - Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting via 'redirect_url' Parameter CVE-2026-88963 6.1 MediumOctober 16, 2026
• themeum tutor lms Tutor LMS < 4.1.1 - Unauthenticated Tutor Page Force-Publish and Content Overwrite CVE-2026-96537 7.5 HighOctober 15, 2026
• themeum kirki – freeform page builder, website builder & customizer Kirki <= 6.2.0 - Authenticated (Custom+) Stored Cross-Site Scripting via Page Builder Text Content CVE-2026-14572 6.4 MediumOctober 15, 2026
• themeum tutor lms – elearning and online course solution Tutor LMS <= 4.1.0 - Reflected Cross-Site Scripting via 'tab' Parameter CVE-2026-100193 4.7 MediumOctober 14, 2026
• themeum tutor lms WordPress Tutor LMS plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability CVE-2026-42702 7.1 HighOctober 10, 2026
• themeum kirki – freeform page builder, website builder & customizer Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'display_name' CVE-2026-102291 5.4 MediumOctober 10, 2026
• themeum tutor lms Tutor LMS 4.0.5 - 4.1.0 - Instructor+ Arbitrary Post Reparenting via IDOR CVE-2026-85571 6.5 MediumOctober 10, 2026
• themeum kirki Kirki < 6.3.2 - Editor+ Blind SSRF via Remote Template URL CVE-2026-84224 4.1 MediumOctober 9, 2026
• themeum kirki Kirki < 6.3.2 - Unauthenticated Arbitrary Shortcode Execution via Comments Collection CVE-2026-84220 4.8 MediumOctober 9, 2026
• themeum tutor lms WordPress Tutor LMS plugin <= 4.1.1 - Race Condition vulnerability CVE-2026-42698 5.3 MediumOctober 8, 2026
• themeum kirki – freeform page builder, website builder & customizer Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Unauthenticated Stored Cross-Site Scripting via Registration Metadata CVE-2026-102173 7.2 HighOctober 7, 2026
• themeum kirki WordPress Kirki plugin <= 6.3.1 - Arbitrary Code Execution vulnerability CVE-2026-103065 8.2 HighOctober 3, 2026
• themeum kirki – freeform page builder, website builder & customizer Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Unauthenticated Blind Server-Side Request Forgery via 'kirki_data' Parameter CVE-2026-18335 5.4 MediumSeptember 24, 2026
• themeum tutor lms – elearning and online course solution Tutor LMS <= 4.0.7 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via 'payload' Parameter CVE-2026-18439 4.3 MediumSeptember 22, 2026
• themeum kirki Kirki 6.0.0 - 6.3.0 - Author+ Stored XSS via Unsanitized SVG Upload CVE-2026-84223 6.8 MediumSeptember 20, 2026
• themeum tutor lms – elearning and online course solution Tutor LMS <= 4.0.8 - Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters CVE-2026-89081 6.1 MediumSeptember 19, 2026
• themeum tutor lms – elearning and online course solution Tutor LMS <= 4.0.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id' Parameter CVE-2026-88944 4.3 MediumSeptember 19, 2026
• themeum tutor lms – elearning and online course solution Tutor LMS <= 4.0.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameter CVE-2026-89333 6.5 MediumSeptember 19, 2026
• themeum wp mega menu WordPress WP Mega Menu plugin <= 1.4.2 - SQL Injection vulnerability CVE-2026-92465 7.6 HighSeptember 16, 2026
• themeum tutor lms Tutor LMS 4.0.0 - < 4.0.8 - Subscriber+ Cross-Course Lesson Comment Disclosure CVE-2026-85572 4.3 MediumSeptember 16, 2026
• themeum tutor lms Tutor LMS 2.7.1 - < 4.0.8 - Read-Only API Key Privilege Escalation via REST Request Misclassification CVE-2026-85569 7.2 HighSeptember 16, 2026
• themeum tutor lms – elearning and online course solution Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution CVE-2026-78175 8.8 HighSeptember 12, 2026
• themeum kirki – freeform page builder, website builder & customizer Kirki <= 6.2.0 - Unauthenticated Stored Cross-Site Scripting via 'comment' Parameter CVE-2026-17037 7.2 HighSeptember 11, 2026
• themeum kirki Kirki 6.2.1 - 6.2.5 - Unauthenticated Non-Public Post Content Disclosure via 'kirki_data' Parameter CVE-2026-84222 5.3 MediumSeptember 9, 2026
• themeum wp crowdfunding WP Crowdfunding <= 2.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'first_name' Parameter CVE-2026-19945 6.4 MediumSeptember 9, 2026
• themeum wp crowdfunding WP Crowdfunding <= 2.2.1 - Authenticated (Shop Manager+) SQL Injection via 'wpneo_reward' Post Meta CVE-2026-19944 4.9 MediumSeptember 9, 2026
• themeum kirki Kirki 6.2.1 - 6.2.5 - Unauthenticated Stored XSS via HTML Entity Decoding CVE-2026-84219 7.5 HighSeptember 6, 2026
• themeum kirki Kirki 6.0.0 - 6.2.5 - Authenticated Collaboration Comment Status Modification via IDOR CVE-2026-84225 2.2 LowSeptember 5, 2026
• themeum kirki Kirki 6.0.0 - 6.2.5 - Editor+ SQLi via Content Manager Field ID CVE-2026-84221 6.8 MediumSeptember 5, 2026
• themeum tutor lms – elearning and online course solution Tutor LMS <= 4.0.5 - Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters CVE-2026-16759 6.5 MediumAugust 28, 2026
• themeum tutor lms Tutor LMS < 4.0.6 - Unauthenticated Arbitrary Zero-Argument Function Invocation via Template Variable Shadowing CVE-2026-19092 9.8 CriticalAugust 27, 2026
• themeum kirki Kirki < 6.0.14 - Unauthenticated User and Comment Author Email Disclosure via kirki_get_apis CVE-2026-77754 5.3 MediumAugust 26, 2026
• themeum tutor lms Tutor LMS < 4.0.6 - Unauthenticated SQLi via 'offset' and 'item_per_page' Parameters CVE-2026-19094 5.3 MediumAugust 26, 2026
• themeum tutor lms Tutor LMS < 4.0.6 - Instructor+ Arbitrary File Read via Video Path CVE-2026-19093 6.8 MediumAugust 22, 2026
• themeum tutor lms Tutor LMS < 4.0.6 - Instructor+ Cross-Instructor Private Course Disclosure via IDOR CVE-2026-14187 2.7 LowAugust 22, 2026
• themeum kirki Kirki < 6.2.3 - Editor+ Stored XSS via Font Zip Upload CVE-2026-74992 6.8 MediumAugust 20, 2026
• themeum kirki WordPress Kirki plugin <= 6.2.3 - Cross Site Scripting (XSS) vulnerability CVE-2026-66629 7.1 HighAugust 18, 2026
• themeum kirki – freeform page builder, website builder & customizer Kirki <= 6.1.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'context' Parameter CVE-2026-18347 4.3 MediumAugust 16, 2026
• themeum kirki – freeform page builder, website builder & customizer Kirki <= 6.1.1 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameter CVE-2026-17604 4.9 MediumAugust 16, 2026
• Show olderLoading…