Skip to contentThemeum vulnerabilities
Newest
- themeum tutor lmsWordPress Tutor LMS plugin <= 3.9.5 - Broken Access Control vulnerabilityCVE-2026-237996.5 Medium
- themeum tutor lms – elearning and online course solutionTutor LMS <= 3.9.6 - Unauthenticated SQL Injection via coupon_codeCVE-2025-13673Public exploit7.5 High
- themeum tutor lms – elearning and online course solutionTutor LMS <= 3.9.5 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Course Modification and DeletionCVE-2026-1375Public exploit8.1 High
- themeum tutor lms – elearning and online course solutionTutor LMS <= 3.9.5 - Authenticated (Subscriber+) Information Disclosure in Coupon Details via 'tutor_coupon_details' AJAX ActionCVE-2026-13715.3 Medium
- themeum tutor lms bunnynet integrationWordPress Tutor LMS BunnyNet Integration plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-245845.9 Medium
- themeum tutor lmsWordPress Tutor LMS plugin <= 3.9.4 - Insecure Direct Object References (IDOR) vulnerabilityCVE-2025-475553.8 Low
- themeum tutor lms – elearning and online course solutionTutor LMS – eLearning and online course solution <= 3.9.4 - Missing Authorization to Authenticated (Subscriber+) Limited Attachment DeletionCVE-2026-05485.4 Medium
- themeum tutor lms – elearning and online course solutionTutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Course CompletionCVE-2025-139354.3 Medium
- themeum tutor lms – elearning and online course solutionTutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Course Enrollment BypassCVE-2025-139344.3 Medium
- themeum tutor lms – elearning and online course solutionTutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Coupon ModificationCVE-2025-136284.3 Medium
- themeum tutor lms – elearning and online course solutionTutor LMS <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via tutor_order_detailsCVE-2025-136796.5 Medium
- themeum tutor lms elementor addonsWordPress Tutor LMS Elementor Addons plugin <= 3.0.1 - Cross Site Scripting (XSS) vulnerabilityCVE-2025-630426.5 Medium
- themeum tutor lms proTutor LMS Pro – eLearning and online course solution <= 3.8.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to View/Edit Other AssignmentsCVE-2025-66395.4 Medium
- themeum tutor lms – elearning and online course solution, tutor lms +1 moreTutor LMS – eLearning and online course solution <= 3.8.3 - Missing Authorization to Unauthenticated Payment Status UpdateCVE-2025-115645.3 Medium
- themeum tutor lms – elearning and online course solution, tutor lms +1 moreTutor LMS <= 3.8.3 - Missing Authorization to Sensitive Information ExposureCVE-2025-66804.3 Medium
- themeum qubelyWordPress Qubely Plugin <= 1.8.14 - Sensitive Data Exposure VulnerabilityCVE-2025-582494.3 Medium
- themeum qubelyWordPress Qubely Plugin <= 1.8.14 - Broken Access Control VulnerabilityCVE-2025-586634.3 Medium
- themeum tutor lmsWordPress Tutor LMS Plugin <= 3.7.4 - SQL Injection VulnerabilityCVE-2025-589937.6 High
- themeum tutor lms proTutor LMS Pro – eLearning and online course solution <= 3.7.0 - Authenticated (Tutor Instructor+) SQL InjectionCVE-2025-61848.8 High
- droipDroip <= 2.2.6 - Missing Authorization to Authenticated (Subscriber+) Many ActionsCVE-2025-58358.8 High
- droipDroip < 2.5.2 - Authenticated (Subscriber+) Arbitrary File UploadCVE-2025-58318.8 High
- themeum tutor lmsWordPress Tutor LMS plugin <= 3.4.0 - HTML Injection vulnerabilityCVE-2025-322304.3 Medium
- themeum wp crowdfundingWordPress WP Crowdfunding plugin <= 2.1.15 - Cross Site Scripting (XSS) vulnerabilityCVE-2025-318926.5 Medium
- themeum wp crowdfundingWP Crowdfunding <= 2.1.14 - Missing Authorization to Authenticated (Subscriber+) Post Content DownloadCVE-2025-15085.3 Medium
- themeum qubely, qubely – advanced gutenberg blocks +1 moreQubely – Advanced Gutenberg Blocks <= 1.8.13 - Authenticated (Contributor+) Sensitive Information Exposure via qubely_get_contentCVE-2024-132284.3 Medium
- themeum qubelyWordPress Qubely plugin <= 1.8.12 - Cross Site Scripting (XSS) vulnerabilityCVE-2025-267676.5 Medium
- themeum qubely, qubely – advanced gutenberg blocks +1 moreQubely – Advanced Gutenberg Blocks <= 1.8.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' and 'UniqueID'CVE-2024-96016.5 Medium
- themeum wp mega menuWordPress WP Mega Menu plugin <= 1.4.2 - PHP Object Injection vulnerabilityCVE-2024-542827.2 High
- themeum wp crowdfundingWordPress WP Crowdfunding plugin <= 2.1.5 - Broken Access Control vulnerabilityCVE-2023-418704.3 Medium
- themeum wp crowdfundingWP Crowdfunding <= 2.1.12 - Missing Authorization to Authenticated (Subscriber+) WooCommerce InstallationCVE-2024-119114.3 Medium
- themeum wp crowdfundingWP Crowdfunding <= 2.1.15 - Authenticated (Contributor+) Stored Cross-Site ScriptingCVE-2024-119106.4 Medium
- themeum tutor lms elementor addonsWordPress Tutor LMS Elementor Addons plugin <= 2.1.5 - Broken Access Control vulnerabilityCVE-2024-538164.3 Medium
- themeum tutor lms, tutor lms – elearning and online course solution +1 moreTutor LMS <= 2.7.6 - Unauthenticated SQL Injection via rating_filterCVE-2024-10400Public exploitEPSS 83.1%7.5 High
- themeum tutor lms, tutor lms – elearning and online course solution +1 moreTutor LMS <= 2.7.6 - User Registration Setting Bypass to Unauthorized User RegistrationCVE-2024-103935.3 Medium
- themeum tutor lms elementor addonsTutor LMS Elementor Addons <= 2.1.5 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin InstallationCVE-2024-108974.3 Medium
- themeum tutor lmsWordPress Tutor LMS plugin <= 2.7.3 - Broken Access Control vulnerabilityCVE-2024-431424.3 Medium
- themeum wp crowdfundingWordPress WP Crowdfunding plugin <= 2.1.10 - Settings Change vulnerabilityCVE-2024-439376.4 Medium
- themeum wp crowdfundingWP Crowdfunding <= 2.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpcf_donate ShortcodeCVE-2024-101176.4 Medium
- themeum tutor lms, tutor lms – elearning and online course solution +1 moreTutor LMS <= 2.7.4 - Cross-Site Request Forgery via 'addon_enable_disable'CVE-2023-29194.3 Medium
- themeum tutor lms pro, tutor lms +1 moreTutor LMS Pro <= 2.7.2 - Missing Authorization to Authenticated (Subscriber+) Insecure Direct Object ReferenceCVE-2024-57847.1 High
- droipWordPress Droip plugin <= 1.1.1 - Unauthenticated Arbitrary File Download/Deletion vulnerabilityCVE-2024-4395510.0 Critical
- droipWordPress Droip plugin <= 1.1.1 - Subscriber+ Settings Change/Data Exposure VulnerabilityCVE-2024-439546.3 Medium
- themeum tutor lmsWordPress Tutor LMS plugin <= 2.7.2 - Cross Site Request Forgery (CSRF) vulnerabilityCVE-2024-396455.4 Medium
- themeum tutor lms elementor addonsTutor LMS Elementor Addons <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Course Carousel WidgetCVE-2024-55766.4 Medium
- themeum tutor lmsWordPress Tutor LMS plugin <= 2.7.2 - SQL Injection vulnerabilityCVE-2024-432827.6 High
- themeum tutor lmsWordPress Tutor LMS plugin <= 2.7.3 - Cross Site Scripting (XSS) vulnerabilityCVE-2024-432316.5 Medium
- themeum tutor lms – migration tool, tutor lms - migration tool +1 moreTutor LMS – Migration Tool <= 2.2.0 - Missing Authorization in tutor_import_from_xmlCVE-2024-18044.3 Medium
- themeum tutor lms – migration tool, tutor lms - migration tool, tutorlms-migrationtool +2 moreTutor LMS – Migration Tool <= 2.2.0 - Missing Authorization in tutor_lp_export_xmlCVE-2024-17985.3 Medium
- themeum tutor lmsWordPress Tutor LMS plugin <= 2.7.2 - Cross Site Scripting (XSS) vulnerabilityCVE-2024-379475.9 Medium
- themeum tutor lmsWordPress Tutor LMS plugin <= 2.7.1 - Path Traversal vulnerabilityCVE-2024-372664.9 Medium
- Show moreLoading…