Themeum vulnerabilities
146 CVEs and advisories name Themeum as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-93779Tutor LMS <= 4.1.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via REST API Endpoints
- CVE-2026-112348Kirki WordPress Plugin < 6.2.5 reCAPTCHA Bypass via Missing Token
- CVE-2026-112347Kirki WordPress Plugin < 6.4.1 Broken Object-Level Access Control via Page API
- CVE-2026-118083WordPress WP Crowdfunding plugin <= 2.2.2 - Sensitive Data Exposure vulnerability
- CVE-2026-42692WordPress WP Crowdfunding plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-42694WordPress Kirki plugin <= 6.4.0 - Content Injection vulnerability
- CVE-2026-75891Kirki <= 6.2.5 - Authenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover via 'get-single-symbol' AJAX Endpoint
- CVE-2026-111407WordPress Tutor LMS plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-92715Tutor LMS <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover via 'ID' Parameter
- CVE-2026-104734Kirki <= 6.3.2 - Authenticated (Administrator+) PHP Object Injection via Deserialization of Untrusted Input via ZIP Template Import
- CVE-2026-107762Kirki <= 6.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via 'context' Parameter
- CVE-2026-93681Tutor LMS <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name Parameter
- CVE-2026-88963Tutor LMS <= 4.0.8 - Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting via 'redirect_url' Parameter
- CVE-2026-14572Kirki <= 6.2.0 - Authenticated (Custom+) Stored Cross-Site Scripting via Page Builder Text Content
- CVE-2026-100193Tutor LMS <= 4.1.0 - Reflected Cross-Site Scripting via 'tab' Parameter
- CVE-2026-42702WordPress Tutor LMS plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-102291Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'display_name'
- CVE-2026-42698WordPress Tutor LMS plugin <= 4.1.1 - Race Condition vulnerability
- CVE-2026-102173Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Unauthenticated Stored Cross-Site Scripting via Registration Metadata
- CVE-2026-103065WordPress Kirki plugin <= 6.3.1 - Arbitrary Code Execution vulnerability
- CVE-2026-18335Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Unauthenticated Blind Server-Side Request Forgery via 'kirki_data' Parameter
- CVE-2026-18439Tutor LMS <= 4.0.7 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via 'payload' Parameter
- CVE-2026-89081Tutor LMS <= 4.0.8 - Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters
- CVE-2026-88944Tutor LMS <= 4.0.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id' Parameter
- CVE-2026-89333Tutor LMS <= 4.0.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameter
- CVE-2026-92465WordPress WP Mega Menu plugin <= 1.4.2 - SQL Injection vulnerability
- CVE-2026-78175Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution
- CVE-2026-17037Kirki <= 6.2.0 - Unauthenticated Stored Cross-Site Scripting via 'comment' Parameter
- CVE-2026-19945WP Crowdfunding <= 2.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'first_name' Parameter
- CVE-2026-19944WP Crowdfunding <= 2.2.1 - Authenticated (Shop Manager+) SQL Injection via 'wpneo_reward' Post Meta