CVEs we hold for Themeum

Records whose assigning authority named Themeum as the affected vendor. Newest identifiers first, capped at 200.

CVE-2026-92465WordPress WP Mega Menu plugin <= 1.4.2 - SQL Injection vulnerabilityThemeum WP Mega Menu

CVE-2026-89333Tutor LMS <= 4.0.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via…themeum Tutor LMS – eLearning and online course solution

CVE-2026-89081Tutor LMS <= 4.0.8 - Reflected Cross-Site Scripting via 'back_url' and 'search' Parametersthemeum Tutor LMS – eLearning and online course solution

CVE-2026-88944Tutor LMS <= 4.0.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id'…themeum Tutor LMS – eLearning and online course solution

CVE-2026-8206Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'themeum Kirki – Freeform Page Builder, Website Builder &…

CVE-2026-8096Kirki <= 6.0.6 - Missing Authorization to Authenticated (Subscriber+) Sensitive Form Submission Data Exposure via…themeum Kirki – Freeform Page Builder, Website Builder &…

CVE-2026-8073Kirki <= 6.0.6 - Unauthenticated Limited Arbitrary File Read and Deletion via downloadZIPthemeum Kirki – Freeform Page Builder, Website Builder &…

CVE-2026-78175Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Executionthemeum Tutor LMS – eLearning and online course solution

CVE-2026-73189WordPress WP Crowdfunding plugin < 2.2.1 - Insecure Direct Object References (IDOR) vulnerabilityThemeum WP Crowdfunding

CVE-2026-6965Tutor LMS <= 3.9.9 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Post Deletion via…themeum Tutor LMS – eLearning and online course solution

CVE-2026-66629WordPress Kirki plugin <= 6.2.3 - Cross Site Scripting (XSS) vulnerabilityThemeum Kirki

CVE-2026-65531WordPress Qubely plugin <= 1.8.14 - Broken Access Control vulnerabilityThemeum Qubely

CVE-2026-65436WordPress Kirki plugin <= 6.0.13 - Arbitrary File Deletion vulnerabilityThemeum Kirki

CVE-2026-6080Tutor LMS <= 3.9.8 - Authenticated (Admin+) SQL Injection via 'date' Parameterthemeum Tutor LMS – eLearning and online course solution

CVE-2026-57727WordPress Kirki plugin <= 6.0.13 - Broken Access Control vulnerabilityThemeum Kirki

CVE-2026-57726WordPress Kirki plugin <= 6.0.12 - SQL Injection vulnerabilityThemeum Kirki

CVE-2026-57725WordPress Kirki plugin <= 6.0.11 - Cross Site Scripting (XSS) vulnerabilityThemeum Kirki

CVE-2026-57724WordPress Kirki plugin <= 6.0.12 - PHP Object Injection vulnerabilityThemeum Kirki

CVE-2026-57694WordPress Tutor LMS plugin <= 3.9.13 - Insecure Direct Object References (IDOR) vulnerabilityThemeum Tutor LMS

CVE-2026-57680WordPress Kirki plugin <= 6.0.11 - Insecure Direct Object References (IDOR) vulnerabilityThemeum Kirki

CVE-2026-57627WordPress Kirki plugin <= 6.0.11 - Server Side Request Forgery (SSRF) vulnerabilityThemeum Kirki

CVE-2026-5502Tutor LMS <= 3.9.8 - Authenticated (Subscriber+) Arbitrary Course Content Manipulation via…themeum Tutor LMS – eLearning and online course solution

CVE-2026-40743WordPress Tutor LMS plugin <= 3.9.7 - Broken Access Control vulnerabilityThemeum Tutor LMS

CVE-2026-40740WordPress Tutor LMS plugin <= 3.9.7 - Broken Access Control vulnerabilityThemeum Tutor LMS

CVE-2026-39638WordPress Qubely plugin <= 1.8.14 - Cross Site Scripting (XSS) vulnerabilityThemeum Qubely

CVE-2026-3371Tutor LMS <= 3.9.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Course Content…themeum Tutor LMS – eLearning and online course solution

CVE-2026-3360Tutor LMS <= 3.9.7 - Missing Authorization to Unauthenticated Arbitrary Billing Profile Overwrite via 'order_id'…themeum Tutor LMS – eLearning and online course solution

CVE-2026-3358Tutor LMS <= 3.9.7 - Missing Authorization to Authenticated (Subscriber+) Unauthorized Private Course Enrollmentthemeum Tutor LMS – eLearning and online course solution

CVE-2026-25406WordPress Tutor LMS Pro plugin <= 3.9.4 - Broken Authentication vulnerabilityThemeum Tutor LMS Pro

CVE-2026-24584WordPress Tutor LMS BunnyNet Integration plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilityThemeum Tutor LMS BunnyNet Integration

CVE-2026-23799WordPress Tutor LMS plugin <= 3.9.5 - Broken Access Control vulnerabilityThemeum Tutor LMS

CVE-2026-22332WordPress Tutor LMS Pro plugin <= 3.9.6 - SQL Injection vulnerabilityThemeum Tutor LMS Pro

CVE-2026-22330WordPress Right Way theme <= 4.0 - Local File Inclusion vulnerabilityThemeum Right Way

CVE-2026-22329WordPress Skillate theme <= 1.2.10 - Reflected Cross Site Scripting (XSS) vulnerabilityThemeum Skillate

CVE-2026-19945WP Crowdfunding <= 2.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'first_name' Parameterthemeum WP Crowdfunding

CVE-2026-19944WP Crowdfunding <= 2.2.1 - Authenticated (Shop Manager+) SQL Injection via 'wpneo_reward' Post Metathemeum WP Crowdfunding

CVE-2026-18347Kirki <= 6.1.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'context'…themeum Kirki – Freeform Page Builder, Website Builder &…

CVE-2026-17604Kirki <= 6.1.1 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameterthemeum Kirki – Freeform Page Builder, Website Builder &…

CVE-2026-17037Kirki <= 6.2.0 - Unauthenticated Stored Cross-Site Scripting via 'comment' Parameterthemeum Kirki – Freeform Page Builder, Website Builder &…

CVE-2026-16974Kirki - Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Authenticated (Contributor+) Stored Cross-Site…themeum Kirki – Freeform Page Builder, Website Builder &…

CVE-2026-16759Tutor LMS <= 4.0.5 - Unauthenticated Remote Code Execution via 'template' and 'data' POST Parametersthemeum Tutor LMS – eLearning and online course solution

CVE-2026-15601Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip)themeum Kirki – Freeform Page Builder, Website Builder &…

CVE-2026-15457Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary Directory Deletion via 'family' Parameterthemeum Kirki – Freeform Page Builder, Website Builder &…

CVE-2026-15444Tutor LMS <= 4.0.1 - Authenticated (Administrator+) SQL Injection via 'coupon_code' Parameterthemeum Tutor LMS – eLearning and online course solution

CVE-2026-15022Tutor LMS <= 4.0.0 - Authenticated (Subscriber+) SQL Injection via Stored Quiz Answer Arraythemeum Tutor LMS – eLearning and online course solution

CVE-2026-1375Tutor LMS <= 3.9.5 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Course Modification and…themeum Tutor LMS – eLearning and online course solution

CVE-2026-1372Tutor LMS Elementor Addons <= 4.0.0 - Missing Authorization to Authenticated (Subscriber+) Tutor LMS and Elementor…themeum Tutor LMS Elementor Addons

CVE-2026-1371Tutor LMS <= 3.9.5 - Authenticated (Subscriber+) Information Disclosure in Coupon Details via 'tutor_coupon_details'…themeum Tutor LMS – eLearning and online course solution

CVE-2026-13464Kirki <= 6.0.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'context'…themeum Kirki – Freeform Page Builder, Website Builder &…

CVE-2026-13443Tutor LMS <= 3.9.13 - Authenticated (Author+) Stored Cross-Site Scripting via Lesson Attachment Titlethemeum Tutor LMS – eLearning and online course solution

CVE-2026-12472Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Arbitrary Email Content Injection (Mail Relay / Phishing)…themeum Kirki – Freeform Page Builder, Website Builder &…

CVE-2026-12122Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via kirki_post_apis_nopriv…themeum Kirki – Freeform Page Builder, Website Builder &…

CVE-2026-10736Tutor LMS <= 3.9.11 - Authenticated (Administrator+) SQL Injection via 'data' Parameterthemeum Tutor LMS – eLearning and online course solution

CVE-2026-0953Tutor LMS Pro <= 3.9.5 - Authentication Bypass via Social Loginthemeum Tutor LMS Pro

CVE-2026-0548Tutor LMS – eLearning and online course solution <= 3.9.4 - Missing Authorization to Authenticated (Subscriber+)…themeum Tutor LMS – eLearning and online course solution

CVE-2025-6680Tutor LMS <= 3.8.3 - Missing Authorization to Sensitive Information Exposurethemeum Tutor LMS – eLearning and online course solution

CVE-2025-6639Tutor LMS Pro – eLearning and online course solution <= 3.8.3 - Authenticated (Subscriber+) Insecure Direct Object…themeum Tutor LMS Pro

CVE-2025-63042WordPress Tutor LMS Elementor Addons plugin <= 3.0.1 - Cross Site Scripting (XSS) vulnerabilityThemeum Tutor LMS Elementor Addons

CVE-2025-6184Tutor LMS Pro – eLearning and online course solution <= 3.7.0 - Authenticated (Tutor Instructor+) SQL Injectionthemeum Tutor LMS Pro

CVE-2025-58993WordPress Tutor LMS Plugin <= 3.7.4 - SQL Injection VulnerabilityThemeum Tutor LMS

CVE-2025-58663WordPress Qubely Plugin <= 1.8.14 - Broken Access Control VulnerabilityThemeum Qubely

CVE-2025-58249WordPress Qubely Plugin <= 1.8.14 - Sensitive Data Exposure VulnerabilityThemeum Qubely

CVE-2025-47555WordPress Tutor LMS plugin <= 3.9.4 - Insecure Direct Object References (IDOR) vulnerabilityThemeum Tutor LMS

CVE-2025-32230WordPress Tutor LMS plugin <= 3.4.0 - HTML Injection vulnerabilityThemeum Tutor LMS

CVE-2025-32223WordPress Tutor LMS plugin <= 3.9.4 - Insecure Direct Object References (IDOR) vulnerabilityThemeum Tutor LMS

CVE-2025-31892WordPress WP Crowdfunding plugin <= 2.1.15 - Cross Site Scripting (XSS) vulnerabilityThemeum WP Crowdfunding

CVE-2025-26767WordPress Qubely plugin <= 1.8.12 - Cross Site Scripting (XSS) vulnerabilityThemeum Qubely

CVE-2025-1508WP Crowdfunding <= 2.1.14 - Missing Authorization to Authenticated (Subscriber+) Post Content Downloadthemeum WP Crowdfunding

CVE-2025-13935Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+)…themeum Tutor LMS – eLearning and online course solution

CVE-2025-13934Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Course…themeum Tutor LMS – eLearning and online course solution

CVE-2025-13679Tutor LMS <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via…themeum Tutor LMS – eLearning and online course solution

CVE-2025-13673Tutor LMS <= 3.9.6 - Unauthenticated SQL Injection via coupon_codethemeum Tutor LMS – eLearning and online course solution

CVE-2025-13628Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+)…themeum Tutor LMS – eLearning and online course solution

CVE-2025-11564Tutor LMS – eLearning and online course solution <= 3.8.3 - Missing Authorization to Unauthenticated Payment Status…themeum Tutor LMS – eLearning and online course solution

CVE-2024-9601Qubely – Advanced Gutenberg Blocks <= 1.8.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' and…themeum Qubely – Advanced Gutenberg Blocks

CVE-2024-5784Tutor LMS Pro <= 2.7.2 - Missing Authorization to Authenticated (Subscriber+) Insecure Direct Object Referencethemeum Tutor LMS Pro

CVE-2024-5576Tutor LMS Elementor Addons <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Course Carousel…themeum Tutor LMS Elementor Addons

CVE-2024-5438Tutor LMS – eLearning and online course solution <= 2.7.1 - Authenticated (Instructor+) Insecure Direct Object…themeum Tutor LMS – eLearning and online course solution

CVE-2024-54282WordPress WP Mega Menu plugin <= 1.4.2 - PHP Object Injection vulnerabilityThemeum WP Mega Menu

CVE-2024-53816WordPress Tutor LMS Elementor Addons plugin <= 2.1.5 - Broken Access Control vulnerabilityThemeum Tutor LMS Elementor Addons

CVE-2024-4902Tutor LMS – eLearning and online course solution <= 2.7.1 -Authenticated (Administrator+) SQL Injectionthemeum Tutor LMS – eLearning and online course solution

CVE-2024-43955WordPress Droip plugin <= 1.1.1 - Unauthenticated Arbitrary File Download/Deletion vulnerabilityThemeum Droip

CVE-2024-43954WordPress Droip plugin <= 1.1.1 - Subscriber+ Settings Change/Data Exposure VulnerabilityThemeum Droip

CVE-2024-43937WordPress WP Crowdfunding plugin <= 2.1.10 - Settings Change vulnerabilityThemeum WP Crowdfunding

CVE-2024-4352Tutor LMS Pro <= 2.7.0 - Missing Authorization to SQL Injectionthemeum Tutor LMS Pro

CVE-2024-4351Tutor LMS Pro <= 2.7.0 - Missing Authorization to Privilege Escalationthemeum Tutor LMS Pro

CVE-2024-43282WordPress Tutor LMS plugin <= 2.7.2 - SQL Injection vulnerabilityThemeum Tutor LMS

CVE-2024-43231WordPress Tutor LMS plugin <= 2.7.3 - Cross Site Scripting (XSS) vulnerabilityThemeum Tutor LMS

CVE-2024-4318Tutor LMS <= 2.7.0 - Authenticated (Instructor+) SQL Injectionthemeum Tutor LMS – eLearning and online course solution

CVE-2024-43142WordPress Tutor LMS plugin <= 2.7.3 - Broken Access Control vulnerabilityThemeum Tutor LMS

CVE-2024-4279Tutor LMS – eLearning and online course solution <= 2.7.0 - Authenticated (Instructor+) Insecure Direct Object…themeum Tutor LMS – eLearning and online course solution

CVE-2024-4223Tutor LMS <= 2.7.0 - Missing Authorizationthemeum Tutor LMS – eLearning and online course solution

CVE-2024-4222Tutor LMS Pro <= 2.7.0 - Missing Authorizationthemeum Tutor LMS Pro

CVE-2024-3994Tutor LMS – eLearning and online course solution <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting…themeum Tutor LMS – eLearning and online course solution

CVE-2024-39645WordPress Tutor LMS plugin <= 2.7.2 - Cross Site Request Forgery (CSRF) vulnerabilityThemeum Tutor LMS

CVE-2024-37947WordPress Tutor LMS plugin <= 2.7.2 - Cross Site Scripting (XSS) vulnerabilityThemeum Tutor LMS

CVE-2024-37266WordPress Tutor LMS plugin <= 2.7.1 - Path Traversal vulnerabilityThemeum Tutor LMS

CVE-2024-37256WordPress Tutor LMS plugin <= 2.7.1 - SQL Injection vulnerabilityThemeum Tutor LMS

CVE-2024-3553Tutor LMS <= 2.6.2 - Missing Authorization to Unauthenticated Limited Options Updatethemeum Tutor LMS – eLearning and online course solution

CVE-2024-29913WordPress Tutor LMS Elementor Addons plugin <= 2.1.3 - Cross Site Scripting (XSS) vulnerabilityThemeum Tutor LMS Elementor Addons

CVE-2024-1804Tutor LMS – Migration Tool <= 2.2.0 - Missing Authorization in tutor_import_from_xmlthemeum Tutor LMS – Migration Tool

CVE-2024-1798Tutor LMS – Migration Tool <= 2.2.0 - Missing Authorization in tutor_lp_export_xmlthemeum Tutor LMS – Migration Tool

CVE-2024-1751Tutor LMS – eLearning and online course solution <= 2.6.1 - Authenticated (Subscriber+) SQL Injectionthemeum Tutor LMS – eLearning and online course solution

CVE-2024-1503Tutor LMS – eLearning and online course solution <= 2.6.1 - Cross-Site Request Forgery to Plugin Deactivation and Data…themeum Tutor LMS – eLearning and online course solution

CVE-2024-1502Tutor LMS – eLearning and online course solution <= 2.6.1 - Missing Authorization to Authenticated (Subscriber+)…themeum Tutor LMS – eLearning and online course solution

CVE-2024-13228Qubely – Advanced Gutenberg Blocks <= 1.8.13 - Authenticated (Contributor+) Sensitive Information Exposure via…themeum Qubely – Advanced Gutenberg Blocks

CVE-2024-11911WP Crowdfunding <= 2.1.12 - Missing Authorization to Authenticated (Subscriber+) WooCommerce Installationthemeum WP Crowdfunding

CVE-2024-11910WP Crowdfunding <= 2.1.15 - Authenticated (Contributor+) Stored Cross-Site Scriptingthemeum WP Crowdfunding

CVE-2024-1133Tutor LMS <= 2.6.0 - Missing Authorizationthemeum Tutor LMS – eLearning and online course solution

CVE-2024-1128Tutor LMS <= 2.6.0 - Authenticated(Student+) HTML Injection via Q&Athemeum Tutor LMS – eLearning and online course solution

CVE-2024-10897Tutor LMS Elementor Addons <= 2.1.5 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installationthemeum Tutor LMS Elementor Addons

CVE-2024-10400Tutor LMS <= 2.7.6 - Unauthenticated SQL Injection via rating_filterthemeum Tutor LMS – eLearning and online course solution

CVE-2024-10393Tutor LMS <= 2.7.6 - User Registration Setting Bypass to Unauthorized User Registrationthemeum Tutor LMS – eLearning and online course solution

CVE-2024-10117WP Crowdfunding <= 2.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpcf_donate Shortcodethemeum WP Crowdfunding

CVE-2023-50859WordPress WP Crowdfunding Plugin <= 2.1.6 is vulnerable to Cross Site Scripting (XSS)Themeum WP Crowdfunding

CVE-2023-49829WordPress Tutor LMS Plugin <= 2.2.4 is vulnerable to Cross Site Scripting (XSS)Themeum Tutor LMS – eLearning and online course solution

CVE-2023-47532WordPress WP Crowdfunding Plugin <= 2.1.6 is vulnerable to Cross Site Scripting (XSS)Themeum WP Crowdfunding

CVE-2023-41870WordPress WP Crowdfunding plugin <= 2.1.5 - Broken Access Control vulnerabilityThemeum WP Crowdfunding

CVE-2023-2919Tutor LMS <= 2.7.4 - Cross-Site Request Forgery via 'addon_enable_disable'themeum Tutor LMS – eLearning and online course solution

CVE-2023-25990WordPress Tutor LMS Plugin <= 2.1.10 is vulnerable to SQL InjectionThemeum Tutor LMS

CVE-2023-25800WordPress Tutor LMS Plugin <= 2.2.0 is vulnerable to SQL InjectionThemeum Tutor LMS

CVE-2023-25799WordPress Tutor LMS plugin <= 2.1.8 - Multiple Broken Access Control vulnerabilitiesThemeum Tutor LMS

CVE-2023-25700WordPress Tutor LMS Plugin <= 2.1.10 is vulnerable to SQL InjectionThemeum Tutor LMS

CVE-2022-40963WordPress WP Page Builder plugin <= 1.2.6 - Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilitiesThemeum WP Page Builder (WordPress plugin)

CVE-2021-24242Tutor LMS < 1.8.8 - Authenticated Local File InclusionThemeum Tutor LMS – eLearning and online course solution

125 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.

Everything on this page is free. Public data. Withholding it protects nothing.