Themeum Tutor Lms vulnerabilities

• themeum tutor lms – elearning and online course solution Tutor LMS <= 4.1.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via REST API Endpoints CVE-2026-93779 6.5 MediumNovember 7, 2026
• themeum tutor lms Tutor LMS 1.6.4 - 4.1.3 - Subscriber+ Quiz Answer Key Disclosure CVE-2026-85570 4.3 MediumNovember 5, 2026
• themeum tutor lms WordPress Tutor LMS plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerability CVE-2026-111407 6.5 MediumOctober 19, 2026
• themeum tutor lms – elearning and online course solution Tutor LMS <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover via 'ID' Parameter CVE-2026-92715 4.3 MediumOctober 17, 2026
• themeum tutor lms – elearning and online course solution Tutor LMS <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name Parameter CVE-2026-93681 6.4 MediumOctober 16, 2026
• themeum tutor lms – elearning and online course solution Tutor LMS <= 4.0.8 - Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting via 'redirect_url' Parameter CVE-2026-88963 6.1 MediumOctober 16, 2026
• themeum tutor lms Tutor LMS < 4.1.1 - Unauthenticated Tutor Page Force-Publish and Content Overwrite CVE-2026-96537 7.5 HighOctober 15, 2026
• themeum tutor lms – elearning and online course solution Tutor LMS <= 4.1.0 - Reflected Cross-Site Scripting via 'tab' Parameter CVE-2026-100193 4.7 MediumOctober 14, 2026
• themeum tutor lms WordPress Tutor LMS plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability CVE-2026-42702 7.1 HighOctober 10, 2026
• themeum tutor lms Tutor LMS 4.0.5 - 4.1.0 - Instructor+ Arbitrary Post Reparenting via IDOR CVE-2026-85571 6.5 MediumOctober 10, 2026
• themeum tutor lms WordPress Tutor LMS plugin <= 4.1.1 - Race Condition vulnerability CVE-2026-42698 5.3 MediumOctober 8, 2026
• themeum tutor lms – elearning and online course solution Tutor LMS <= 4.0.7 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via 'payload' Parameter CVE-2026-18439 4.3 MediumSeptember 22, 2026
• themeum tutor lms – elearning and online course solution Tutor LMS <= 4.0.8 - Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters CVE-2026-89081 6.1 MediumSeptember 19, 2026
• themeum tutor lms – elearning and online course solution Tutor LMS <= 4.0.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id' Parameter CVE-2026-88944 4.3 MediumSeptember 19, 2026
• themeum tutor lms – elearning and online course solution Tutor LMS <= 4.0.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameter CVE-2026-89333 6.5 MediumSeptember 19, 2026
• themeum tutor lms Tutor LMS 4.0.0 - < 4.0.8 - Subscriber+ Cross-Course Lesson Comment Disclosure CVE-2026-85572 4.3 MediumSeptember 16, 2026
• themeum tutor lms Tutor LMS 2.7.1 - < 4.0.8 - Read-Only API Key Privilege Escalation via REST Request Misclassification CVE-2026-85569 7.2 HighSeptember 16, 2026
• themeum tutor lms – elearning and online course solution Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution CVE-2026-78175 8.8 HighSeptember 12, 2026
• themeum tutor lms – elearning and online course solution Tutor LMS <= 4.0.5 - Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters CVE-2026-16759 6.5 MediumAugust 28, 2026
• themeum tutor lms Tutor LMS < 4.0.6 - Unauthenticated Arbitrary Zero-Argument Function Invocation via Template Variable Shadowing CVE-2026-19092 9.8 CriticalAugust 27, 2026
• themeum tutor lms Tutor LMS < 4.0.6 - Unauthenticated SQLi via 'offset' and 'item_per_page' Parameters CVE-2026-19094 5.3 MediumAugust 26, 2026
• themeum tutor lms Tutor LMS < 4.0.6 - Instructor+ Arbitrary File Read via Video Path CVE-2026-19093 6.8 MediumAugust 22, 2026
• themeum tutor lms Tutor LMS < 4.0.6 - Instructor+ Cross-Instructor Private Course Disclosure via IDOR CVE-2026-14187 2.7 LowAugust 22, 2026
• themeum tutor lms Tutor LMS < 3.9.14 - Subscriber+ Paid Course Content Disclosure via Enrollment Check Bypass CVE-2026-14306 4.3 MediumAugust 6, 2026
• themeum tutor lms Tutor LMS < 4.0.0 - Subscriber+ Cross-Course Q&A Content Disclosure and Reply Injection CVE-2026-14310 5.4 MediumJuly 30, 2026
• themeum tutor lms – elearning and online course solution Tutor LMS <= 4.0.1 - Authenticated (Administrator+) SQL Injection via 'coupon_code' Parameter CVE-2026-15444 4.9 MediumJuly 28, 2026
• themeum tutor lms elementor addons Tutor LMS Elementor Addons <= 4.0.0 - Missing Authorization to Authenticated (Subscriber+) Tutor LMS and Elementor Plugin Activation CVE-2026-1372 4.3 MediumJuly 21, 2026
• themeum tutor lms – elearning and online course solution Tutor LMS <= 4.0.0 - Authenticated (Subscriber+) SQL Injection via Stored Quiz Answer Array CVE-2026-15022 6.5 MediumJuly 16, 2026
• themeum tutor lms WordPress Tutor LMS plugin <= 3.9.13 - Insecure Direct Object References (IDOR) vulnerability CVE-2026-57694 6.5 MediumJuly 13, 2026
• themeum tutor lms Tutor LMS < 3.9.13 - Subscriber+ Unauthorized Course Enrollment and Private Course Content Disclosure via Droip/Kirki Integration CVE-2026-12275 7.1 HighJuly 13, 2026
• themeum tutor lms Tutor LMS < 3.9.13 - Instructor+ Arbitrary Post Overwrite via IDOR CVE-2026-12274 6.5 MediumJuly 13, 2026
• themeum tutor lms Tutor LMS < 3.9.13 - Subscriber+ Arbitrary Auto-Approved Comment Creation CVE-2026-12273 4.3 MediumJuly 13, 2026
• themeum tutor lms Tutor LMS < 3.9.13 - Subscriber+ Arbitrary Quiz Attempt Modification via IDOR CVE-2026-12271 5.4 MediumJuly 13, 2026
• themeum tutor lms – elearning and online course solution Tutor LMS <= 3.9.13 - Authenticated (Author+) Stored Cross-Site Scripting via Lesson Attachment Title CVE-2026-13443 6.4 MediumJuly 1, 2026
• themeum tutor lms – elearning and online course solution Tutor LMS <= 3.9.11 - Authenticated (Administrator+) SQL Injection via 'data' Parameter CVE-2026-10736 4.9 MediumJune 18, 2026
• themeum tutor lms pro WordPress Tutor LMS Pro plugin <= 3.9.6 - SQL Injection vulnerability CVE-2026-22332 9.3 CriticalJune 17, 2026
• themeum tutor lms WordPress Tutor LMS plugin <= 3.9.7 - Broken Access Control vulnerability CVE-2026-40743 6.5 MediumJune 15, 2026
• themeum tutor lms – elearning and online course solution Tutor LMS <= 3.9.9 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Post Deletion via 'course' GET Parameter CVE-2026-6965 5.3 MediumMay 13, 2026
• themeum tutor lms – elearning and online course solution Tutor LMS <= 3.9.8 - Authenticated (Subscriber+) Arbitrary Course Content Manipulation via tutor_update_course_content_order CVE-2026-5502 5.3 MediumApril 17, 2026
• themeum tutor lms – elearning and online course solution Tutor LMS <= 3.9.8 - Authenticated (Admin+) SQL Injection via 'date' Parameter CVE-2026-6080 6.5 MediumApril 17, 2026
• themeum tutor lms WordPress Tutor LMS plugin <= 3.9.7 - Broken Access Control vulnerability CVE-2026-40740 5.4 MediumApril 15, 2026
• themeum tutor lms – elearning and online course solution Tutor LMS <= 3.9.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Course Content Modification CVE-2026-3371 4.3 MediumApril 11, 2026
• themeum tutor lms – elearning and online course solution Tutor LMS <= 3.9.7 - Missing Authorization to Authenticated (Subscriber+) Unauthorized Private Course Enrollment CVE-2026-3358 5.4 MediumApril 11, 2026
• themeum tutor lms – elearning and online course solution Tutor LMS <= 3.9.7 - Missing Authorization to Unauthenticated Arbitrary Billing Profile Overwrite via 'order_id' Parameter CVE-2026-3360 7.5 HighApril 10, 2026
• themeum tutor lms pro WordPress Tutor LMS Pro plugin <= 3.9.4 - Broken Authentication vulnerability CVE-2026-25406 8.1 HighMarch 25, 2026
• themeum tutor lms WordPress Tutor LMS plugin <= 3.9.4 - Insecure Direct Object References (IDOR) vulnerability CVE-2025-32223 6.5 MediumMarch 19, 2026
• themeum tutor lms pro Tutor LMS Pro <= 3.9.5 - Authentication Bypass via Social Login CVE-2026-0953 9.8 CriticalMarch 10, 2026
• themeum tutor lms WordPress Tutor LMS plugin <= 3.9.5 - Broken Access Control vulnerability CVE-2026-23799 6.5 MediumMarch 5, 2026
• themeum tutor lms – elearning and online course solution Tutor LMS <= 3.9.6 - Unauthenticated SQL Injection via coupon_code CVE-2025-13673 Public exploit 7.5 HighFebruary 28, 2026
• themeum tutor lms – elearning and online course solution Tutor LMS <= 3.9.5 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Course Modification and Deletion CVE-2026-1375 Public exploit 8.1 HighFebruary 3, 2026
• Show olderLoading…