Skip to contentThemeum vulnerabilities
Newest
- themeum kirkiKirki < 6.2.1 - Unauthenticated Arbitrary Shortcode Execution via Form Email ActionsCVE-2026-167476.5 Medium
- themeum kirki – freeform page builder, website builder & customizerKirki - Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_meta ShortcodeCVE-2026-169746.4 Medium
- themeum tutor lmsTutor LMS < 3.9.14 - Subscriber+ Paid Course Content Disclosure via Enrollment Check BypassCVE-2026-143064.3 Medium
- themeum kirki – freeform page builder, website builder & customizerKirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip)CVE-2026-156014.9 Medium
- themeum kirkiKirki < 6.0.13 - Unauthenticated SQL InjectionCVE-2026-127218.6 High
- themeum kirkiKirki < 6.0.13 - Unauthenticated PHP Object InjectionCVE-2026-127207.5 High
- themeum tutor lmsTutor LMS < 4.0.0 - Subscriber+ Cross-Course Q&A Content Disclosure and Reply InjectionCVE-2026-143105.4 Medium
- themeum tutor lms – elearning and online course solutionTutor LMS <= 4.0.1 - Authenticated (Administrator+) SQL Injection via 'coupon_code' ParameterCVE-2026-154444.9 Medium
- themeum kirkiWordPress Kirki plugin <= 6.0.13 - Arbitrary File Deletion vulnerabilityCVE-2026-654366.8 Medium
- themeum kirki – freeform page builder, website builder & customizerKirki <= 6.0.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'context' ParameterCVE-2026-134645.3 Medium
- themeum qubelyWordPress Qubely plugin <= 1.8.14 - Broken Access Control vulnerabilityCVE-2026-655314.8 Medium
- themeum tutor lms elementor addonsTutor LMS Elementor Addons <= 4.0.0 - Missing Authorization to Authenticated (Subscriber+) Tutor LMS and Elementor Plugin ActivationCVE-2026-13724.3 Medium
- themeum kirkiKirki < 6.0.12 - Unauthenticated Server-Side Request Forgery via kirki_get_apisCVE-2026-131479.1 Critical
- themeum kirkiKirki < 6.0.12 - Unauthenticated HTML Injection in Password Reset Email via kirki-forgot-passwordCVE-2026-127244.3 Medium
- themeum kirkiKirki < 6.0.12 - Unauthenticated Arbitrary Comment Modification and Moderation Bypass via Component LibraryCVE-2026-127235.3 Medium
- themeum kirki – freeform page builder, website builder & customizerKirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary Directory Deletion via 'family' ParameterCVE-2026-154574.9 Medium
- themeum tutor lms – elearning and online course solutionTutor LMS <= 4.0.0 - Authenticated (Subscriber+) SQL Injection via Stored Quiz Answer ArrayCVE-2026-150226.5 Medium
- themeum kirkiWordPress Kirki plugin <= 6.2.0 - Broken Access Control vulnerabilityCVE-2026-577277.5 High
- themeum kirkiWordPress Kirki plugin <= 6.0.12 - SQL Injection vulnerabilityCVE-2026-577269.3 Critical
- themeum kirkiWordPress Kirki plugin <= 6.0.11 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-577257.1 High
- themeum kirkiWordPress Kirki plugin <= 6.0.12 - PHP Object Injection vulnerabilityCVE-2026-577249.8 Critical
- themeum tutor lmsWordPress Tutor LMS plugin <= 3.9.13 - Insecure Direct Object References (IDOR) vulnerabilityCVE-2026-576946.5 Medium
- themeum tutor lmsTutor LMS < 3.9.13 - Subscriber+ Unauthorized Course Enrollment and Private Course Content Disclosure via Droip/Kirki IntegrationCVE-2026-122757.1 High
- themeum tutor lmsTutor LMS < 3.9.13 - Instructor+ Arbitrary Post Overwrite via IDORCVE-2026-122746.5 Medium
- themeum tutor lmsTutor LMS < 3.9.13 - Subscriber+ Arbitrary Auto-Approved Comment CreationCVE-2026-122734.3 Medium
- themeum tutor lmsTutor LMS < 3.9.13 - Subscriber+ Arbitrary Quiz Attempt Modification via IDORCVE-2026-122715.4 Medium
- themeum kirkiWordPress Kirki plugin <= 6.0.11 - Insecure Direct Object References (IDOR) vulnerabilityCVE-2026-576806.5 Medium
- themeum kirki – freeform page builder, website builder & customizerKirki <= 6.0.11 - Missing Authorization to Unauthenticated Arbitrary Email Content Injection (Mail Relay / Phishing) via 'emailBody' and 'emailSubject' ParametersCVE-2026-124725.3 Medium
- themeum kirki – freeform page builder, website builder & customizerKirki <= 6.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via kirki_post_apis_nopriv AJAX ActionCVE-2026-121225.3 Medium
- themeum tutor lms – elearning and online course solutionTutor LMS <= 3.9.13 - Authenticated (Author+) Stored Cross-Site Scripting via Lesson Attachment TitleCVE-2026-134436.4 Medium
- themeum kirkiWordPress Kirki plugin <= 6.0.11 - Server Side Request Forgery (SSRF) vulnerabilityCVE-2026-576274.9 Medium
- themeum tutor lms – elearning and online course solutionTutor LMS <= 3.9.11 - Authenticated (Administrator+) SQL Injection via 'data' ParameterCVE-2026-107364.9 Medium
- themeum tutor lms proWordPress Tutor LMS Pro plugin <= 3.9.6 - SQL Injection vulnerabilityCVE-2026-223329.3 Critical
- themeum right wayWordPress Right Way theme <= 4.0 - Local File Inclusion vulnerabilityCVE-2026-223308.1 High
- themeum skillateWordPress Skillate theme <= 1.2.10 - Reflected Cross Site Scripting (XSS) vulnerabilityCVE-2026-223297.1 High
- themeum tutor lmsWordPress Tutor LMS plugin <= 3.9.7 - Broken Access Control vulnerabilityCVE-2026-407436.5 Medium
- themeum kirki – freeform page builder, website builder & customizerKirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'CVE-2026-8206Public exploit9.8 Critical
- themeum kirki – freeform page builder, website builder & customizerKirki <= 6.0.6 - Unauthenticated Limited Arbitrary File Read and Deletion via downloadZIPCVE-2026-80737.5 High
- themeum kirki – freeform page builder, website builder & customizerKirki <= 6.0.6 - Missing Authorization to Authenticated (Subscriber+) Sensitive Form Submission Data Exposure via 'kirki_wp_admin_get_apis' ActionCVE-2026-80966.5 Medium
- themeum tutor lms – elearning and online course solutionTutor LMS <= 3.9.9 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Post Deletion via 'course' GET ParameterCVE-2026-69655.3 Medium
- themeum tutor lms – elearning and online course solutionTutor LMS <= 3.9.8 - Authenticated (Subscriber+) Arbitrary Course Content Manipulation via tutor_update_course_content_orderCVE-2026-55025.3 Medium
- themeum tutor lms – elearning and online course solutionTutor LMS <= 3.9.8 - Authenticated (Admin+) SQL Injection via 'date' ParameterCVE-2026-60806.5 Medium
- themeum tutor lmsWordPress Tutor LMS plugin <= 3.9.7 - Broken Access Control vulnerabilityCVE-2026-407405.4 Medium
- themeum tutor lms – elearning and online course solutionTutor LMS <= 3.9.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Course Content ModificationCVE-2026-33714.3 Medium
- themeum tutor lms – elearning and online course solutionTutor LMS <= 3.9.7 - Missing Authorization to Authenticated (Subscriber+) Unauthorized Private Course EnrollmentCVE-2026-33585.4 Medium
- themeum tutor lms – elearning and online course solutionTutor LMS <= 3.9.7 - Missing Authorization to Unauthenticated Arbitrary Billing Profile Overwrite via 'order_id' ParameterCVE-2026-33607.5 High
- themeum qubelyWordPress Qubely plugin <= 1.8.14 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-396385.9 Medium
- themeum tutor lms proWordPress Tutor LMS Pro plugin <= 3.9.4 - Broken Authentication vulnerabilityCVE-2026-254068.1 High
- themeum tutor lmsWordPress Tutor LMS plugin <= 3.9.4 - Insecure Direct Object References (IDOR) vulnerabilityCVE-2025-322236.5 Medium
- themeum tutor lms proTutor LMS Pro <= 3.9.5 - Authentication Bypass via Social LoginCVE-2026-09539.8 Critical
- Show moreLoading…