# cve.now: Themeum

The newest entries naming Themeum as an affected vendor (up to 200), of 146 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-93779](https://cve.now/CVE-2026-93779.md): Tutor LMS \<= 4.1.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via REST API Endpoints (CVSS 6.5)
- [CVE-2026-112348](https://cve.now/CVE-2026-112348.md): Kirki WordPress Plugin \< 6.2.5 reCAPTCHA Bypass via Missing Token (CVSS 6.9)
- [CVE-2026-112347](https://cve.now/CVE-2026-112347.md): Kirki WordPress Plugin \< 6.4.1 Broken Object-Level Access Control via Page API (CVSS 7.2)
- [CVE-2026-118083](https://cve.now/CVE-2026-118083.md): WordPress WP Crowdfunding plugin \<= 2.2.2 - Sensitive Data Exposure vulnerability (CVSS 7.5)
- [CVE-2026-42692](https://cve.now/CVE-2026-42692.md): WordPress WP Crowdfunding plugin \<= 2.2.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-42694](https://cve.now/CVE-2026-42694.md): WordPress Kirki plugin \<= 6.4.0 - Content Injection vulnerability (CVSS 4.3)
- [CVE-2026-75891](https://cve.now/CVE-2026-75891.md): Kirki \<= 6.2.5 - Authenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover via 'get-single-symbol' AJAX Endpoint (CVSS 8.8)
- [CVE-2026-111407](https://cve.now/CVE-2026-111407.md): WordPress Tutor LMS plugin \<= 4.1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-92715](https://cve.now/CVE-2026-92715.md): Tutor LMS \<= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover via 'ID' Parameter (CVSS 4.3)
- [CVE-2026-104734](https://cve.now/CVE-2026-104734.md): Kirki \<= 6.3.2 - Authenticated (Administrator+) PHP Object Injection via Deserialization of Untrusted Input via ZIP Template Import (CVSS 7.2)
- [CVE-2026-107762](https://cve.now/CVE-2026-107762.md): Kirki \<= 6.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via 'context' Parameter (CVSS 7.5)
- [CVE-2026-93681](https://cve.now/CVE-2026-93681.md): Tutor LMS \<= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display\_name Parameter (CVSS 6.4)
- [CVE-2026-88963](https://cve.now/CVE-2026-88963.md): Tutor LMS \<= 4.0.8 - Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting via 'redirect\_url' Parameter (CVSS 6.1)
- [CVE-2026-14572](https://cve.now/CVE-2026-14572.md): Kirki \<= 6.2.0 - Authenticated (Custom+) Stored Cross-Site Scripting via Page Builder Text Content (CVSS 6.4)
- [CVE-2026-100193](https://cve.now/CVE-2026-100193.md): Tutor LMS \<= 4.1.0 - Reflected Cross-Site Scripting via 'tab' Parameter (CVSS 4.7)
- [CVE-2026-42702](https://cve.now/CVE-2026-42702.md): WordPress Tutor LMS plugin \<= 4.1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-102291](https://cve.now/CVE-2026-102291.md): Kirki – Freeform Page Builder, Website Builder & Customizer \<= 6.3.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'display\_name' (CVSS 5.4)
- [CVE-2026-42698](https://cve.now/CVE-2026-42698.md): WordPress Tutor LMS plugin \<= 4.1.1 - Race Condition vulnerability (CVSS 5.3)
- [CVE-2026-102173](https://cve.now/CVE-2026-102173.md): Kirki – Freeform Page Builder, Website Builder & Customizer \<= 6.3.1 - Unauthenticated Stored Cross-Site Scripting via Registration Metadata (CVSS 7.2)
- [CVE-2026-103065](https://cve.now/CVE-2026-103065.md): WordPress Kirki plugin \<= 6.3.1 - Arbitrary Code Execution vulnerability (CVSS 8.2)
- [CVE-2026-18335](https://cve.now/CVE-2026-18335.md): Kirki – Freeform Page Builder, Website Builder & Customizer \<= 6.2.0 - Unauthenticated Blind Server-Side Request Forgery via 'kirki\_data' Parameter (CVSS 5.4)
- [CVE-2026-18439](https://cve.now/CVE-2026-18439.md): Tutor LMS \<= 4.0.7 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via 'payload' Parameter (CVSS 4.3)
- [CVE-2026-89081](https://cve.now/CVE-2026-89081.md): Tutor LMS \<= 4.0.8 - Reflected Cross-Site Scripting via 'back\_url' and 'search' Parameters (CVSS 6.1)
- [CVE-2026-88944](https://cve.now/CVE-2026-88944.md): Tutor LMS \<= 4.0.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson\_id' Parameter (CVSS 4.3)
- [CVE-2026-89333](https://cve.now/CVE-2026-89333.md): Tutor LMS \<= 4.0.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student\_id' Parameter (CVSS 6.5)
- [CVE-2026-92465](https://cve.now/CVE-2026-92465.md): WordPress WP Mega Menu plugin \<= 1.4.2 - SQL Injection vulnerability (CVSS 7.6)
- [CVE-2026-78175](https://cve.now/CVE-2026-78175.md): Tutor LMS \<= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution (CVSS 8.8)
- [CVE-2026-17037](https://cve.now/CVE-2026-17037.md): Kirki \<= 6.2.0 - Unauthenticated Stored Cross-Site Scripting via 'comment' Parameter (CVSS 7.2)
- [CVE-2026-19945](https://cve.now/CVE-2026-19945.md): WP Crowdfunding \<= 2.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'first\_name' Parameter (CVSS 6.4)
- [CVE-2026-19944](https://cve.now/CVE-2026-19944.md): WP Crowdfunding \<= 2.2.1 - Authenticated (Shop Manager+) SQL Injection via 'wpneo\_reward' Post Meta (CVSS 4.9)
- [CVE-2026-16759](https://cve.now/CVE-2026-16759.md): Tutor LMS \<= 4.0.5 - Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters (CVSS 6.5)
- [CVE-2026-66629](https://cve.now/CVE-2026-66629.md): WordPress Kirki plugin \<= 6.2.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-18347](https://cve.now/CVE-2026-18347.md): Kirki \<= 6.1.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'context' Parameter (CVSS 4.3)
- [CVE-2026-17604](https://cve.now/CVE-2026-17604.md): Kirki \<= 6.1.1 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameter (CVSS 4.9)
- [CVE-2026-16974](https://cve.now/CVE-2026-16974.md): Kirki - Freeform Page Builder, Website Builder & Customizer \<= 6.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post\_meta Shortcode (CVSS 6.4)
- [CVE-2026-15601](https://cve.now/CVE-2026-15601.md): Kirki \<= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip) (CVSS 4.9)
- [CVE-2026-15444](https://cve.now/CVE-2026-15444.md): Tutor LMS \<= 4.0.1 - Authenticated (Administrator+) SQL Injection via 'coupon\_code' Parameter (CVSS 4.9)
- [CVE-2026-65436](https://cve.now/CVE-2026-65436.md): WordPress Kirki plugin \<= 6.0.13 - Arbitrary File Deletion vulnerability (CVSS 6.8)
- [CVE-2026-13464](https://cve.now/CVE-2026-13464.md): Kirki \<= 6.0.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'context' Parameter (CVSS 5.3)
- [CVE-2026-65531](https://cve.now/CVE-2026-65531.md): WordPress Qubely plugin \<= 1.8.14 - Broken Access Control vulnerability (CVSS 4.8)
- [CVE-2026-1372](https://cve.now/CVE-2026-1372.md): Tutor LMS Elementor Addons \<= 4.0.0 - Missing Authorization to Authenticated (Subscriber+) Tutor LMS and Elementor Plugin Activation (CVSS 4.3)
- [CVE-2026-15457](https://cve.now/CVE-2026-15457.md): Kirki \<= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary Directory Deletion via 'family' Parameter (CVSS 4.9)
- [CVE-2026-15022](https://cve.now/CVE-2026-15022.md): Tutor LMS \<= 4.0.0 - Authenticated (Subscriber+) SQL Injection via Stored Quiz Answer Array (CVSS 6.5)
- [CVE-2026-57724](https://cve.now/CVE-2026-57724.md): WordPress Kirki plugin \<= 6.0.12 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2026-57725](https://cve.now/CVE-2026-57725.md): WordPress Kirki plugin \<= 6.0.11 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-57726](https://cve.now/CVE-2026-57726.md): WordPress Kirki plugin \<= 6.0.12 - SQL Injection vulnerability (CVSS 9.3)
- [CVE-2026-57727](https://cve.now/CVE-2026-57727.md): WordPress Kirki plugin \<= 6.2.0 - Broken Access Control vulnerability (CVSS 7.5)
- [CVE-2026-57694](https://cve.now/CVE-2026-57694.md): WordPress Tutor LMS plugin \<= 3.9.13 - Insecure Direct Object References (IDOR) vulnerability (CVSS 6.5)
- [CVE-2026-57680](https://cve.now/CVE-2026-57680.md): WordPress Kirki plugin \<= 6.0.11 - Insecure Direct Object References (IDOR) vulnerability (CVSS 6.5)
- [CVE-2026-12472](https://cve.now/CVE-2026-12472.md): Kirki \<= 6.0.11 - Missing Authorization to Unauthenticated Arbitrary Email Content Injection (Mail Relay / Phishing) via 'emailBody' and 'emailSubject' Parameters (CVSS 5.3)
- [CVE-2026-12122](https://cve.now/CVE-2026-12122.md): Kirki \<= 6.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via kirki\_post\_apis\_nopriv AJAX Action (CVSS 5.3)
- [CVE-2026-13443](https://cve.now/CVE-2026-13443.md): Tutor LMS \<= 3.9.13 - Authenticated (Author+) Stored Cross-Site Scripting via Lesson Attachment Title (CVSS 6.4)
- [CVE-2026-57627](https://cve.now/CVE-2026-57627.md): WordPress Kirki plugin \<= 6.0.11 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.9)
- [CVE-2026-10736](https://cve.now/CVE-2026-10736.md): Tutor LMS \<= 3.9.11 - Authenticated (Administrator+) SQL Injection via 'data' Parameter (CVSS 4.9)
- [CVE-2026-22332](https://cve.now/CVE-2026-22332.md): WordPress Tutor LMS Pro plugin \<= 3.9.6 - SQL Injection vulnerability (CVSS 9.3)
- [CVE-2026-22330](https://cve.now/CVE-2026-22330.md): WordPress Right Way theme \<= 4.0 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2026-22329](https://cve.now/CVE-2026-22329.md): WordPress Skillate theme \<= 1.2.10 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-40743](https://cve.now/CVE-2026-40743.md): WordPress Tutor LMS plugin \<= 3.9.7 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2026-8206](https://cve.now/CVE-2026-8206.md): Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle\_forgot\_password' (CVSS 9.8)
- [CVE-2026-8073](https://cve.now/CVE-2026-8073.md): Kirki \<= 6.0.6 - Unauthenticated Limited Arbitrary File Read and Deletion via downloadZIP (CVSS 7.5)
- [CVE-2026-8096](https://cve.now/CVE-2026-8096.md): Kirki \<= 6.0.6 - Missing Authorization to Authenticated (Subscriber+) Sensitive Form Submission Data Exposure via 'kirki\_wp\_admin\_get\_apis' Action (CVSS 6.5)
- [CVE-2026-6965](https://cve.now/CVE-2026-6965.md): Tutor LMS \<= 3.9.9 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Post Deletion via 'course' GET Parameter (CVSS 5.3)
- [CVE-2026-5502](https://cve.now/CVE-2026-5502.md): Tutor LMS \<= 3.9.8 - Authenticated (Subscriber+) Arbitrary Course Content Manipulation via tutor\_update\_course\_content\_order (CVSS 5.3)
- [CVE-2026-6080](https://cve.now/CVE-2026-6080.md): Tutor LMS \<= 3.9.8 - Authenticated (Admin+) SQL Injection via 'date' Parameter (CVSS 6.5)
- [CVE-2026-40740](https://cve.now/CVE-2026-40740.md): WordPress Tutor LMS plugin \<= 3.9.7 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2026-3371](https://cve.now/CVE-2026-3371.md): Tutor LMS \<= 3.9.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Course Content Modification (CVSS 4.3)
- [CVE-2026-3358](https://cve.now/CVE-2026-3358.md): Tutor LMS \<= 3.9.7 - Missing Authorization to Authenticated (Subscriber+) Unauthorized Private Course Enrollment (CVSS 5.4)
- [CVE-2026-3360](https://cve.now/CVE-2026-3360.md): Tutor LMS \<= 3.9.7 - Missing Authorization to Unauthenticated Arbitrary Billing Profile Overwrite via 'order\_id' Parameter (CVSS 7.5)
- [CVE-2026-39638](https://cve.now/CVE-2026-39638.md): WordPress Qubely plugin \<= 1.8.14 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2026-25406](https://cve.now/CVE-2026-25406.md): WordPress Tutor LMS Pro plugin \<= 3.9.4 - Broken Authentication vulnerability (CVSS 8.1)
- [CVE-2025-32223](https://cve.now/CVE-2025-32223.md): WordPress Tutor LMS plugin \<= 3.9.4 - Insecure Direct Object References (IDOR) vulnerability (CVSS 6.5)
- [CVE-2026-0953](https://cve.now/CVE-2026-0953.md): Tutor LMS Pro \<= 3.9.5 - Authentication Bypass via Social Login (CVSS 9.8)
- [CVE-2026-23799](https://cve.now/CVE-2026-23799.md): WordPress Tutor LMS plugin \<= 3.9.5 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2025-13673](https://cve.now/CVE-2025-13673.md): Tutor LMS \<= 3.9.6 - Unauthenticated SQL Injection via coupon\_code (CVSS 7.5)
- [CVE-2026-1371](https://cve.now/CVE-2026-1371.md): Tutor LMS \<= 3.9.5 - Authenticated (Subscriber+) Information Disclosure in Coupon Details via 'tutor\_coupon\_details' AJAX Action (CVSS 5.3)
- [CVE-2026-1375](https://cve.now/CVE-2026-1375.md): Tutor LMS \<= 3.9.5 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Course Modification and Deletion (CVSS 8.1)
- [CVE-2026-24584](https://cve.now/CVE-2026-24584.md): WordPress Tutor LMS BunnyNet Integration plugin \<= 1.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2025-47555](https://cve.now/CVE-2025-47555.md): WordPress Tutor LMS plugin \<= 3.9.4 - Insecure Direct Object References (IDOR) vulnerability (CVSS 3.8)
- [CVE-2026-0548](https://cve.now/CVE-2026-0548.md): Tutor LMS – eLearning and online course solution \<= 3.9.4 - Missing Authorization to Authenticated (Subscriber+) Limited Attachment Deletion (CVSS 5.4)
- [CVE-2025-13935](https://cve.now/CVE-2025-13935.md): Tutor LMS – eLearning and online course solution \<= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Course Completion (CVSS 4.3)
- [CVE-2025-13934](https://cve.now/CVE-2025-13934.md): Tutor LMS – eLearning and online course solution \<= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Course Enrollment Bypass (CVSS 4.3)
- [CVE-2025-13628](https://cve.now/CVE-2025-13628.md): Tutor LMS – eLearning and online course solution \<= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Coupon Modification (CVSS 4.3)
- [CVE-2025-13679](https://cve.now/CVE-2025-13679.md): Tutor LMS \<= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via tutor\_order\_details (CVSS 6.5)
- [CVE-2025-63042](https://cve.now/CVE-2025-63042.md): WordPress Tutor LMS Elementor Addons plugin \<= 3.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-6639](https://cve.now/CVE-2025-6639.md): Tutor LMS Pro – eLearning and online course solution \<= 3.8.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to View/Edit Other Assignments (CVSS 5.4)
- [CVE-2025-11564](https://cve.now/CVE-2025-11564.md): Tutor LMS – eLearning and online course solution \<= 3.8.3 - Missing Authorization to Unauthenticated Payment Status Update (CVSS 5.3)
- [CVE-2025-6680](https://cve.now/CVE-2025-6680.md): Tutor LMS \<= 3.8.3 - Missing Authorization to Sensitive Information Exposure (CVSS 4.3)
- [CVE-2025-58249](https://cve.now/CVE-2025-58249.md): WordPress Qubely Plugin \<= 1.8.14 - Sensitive Data Exposure Vulnerability (CVSS 4.3)
- [CVE-2025-58663](https://cve.now/CVE-2025-58663.md): WordPress Qubely Plugin \<= 1.8.14 - Broken Access Control Vulnerability (CVSS 4.3)
- [CVE-2025-58993](https://cve.now/CVE-2025-58993.md): WordPress Tutor LMS Plugin \<= 3.7.4 - SQL Injection Vulnerability (CVSS 7.6)
- [CVE-2025-6184](https://cve.now/CVE-2025-6184.md): Tutor LMS Pro – eLearning and online course solution \<= 3.7.0 - Authenticated (Tutor Instructor+) SQL Injection (CVSS 8.8)
- [CVE-2025-32230](https://cve.now/CVE-2025-32230.md): WordPress Tutor LMS plugin \<= 3.4.0 - HTML Injection vulnerability (CVSS 4.3)
- [CVE-2025-31892](https://cve.now/CVE-2025-31892.md): WordPress WP Crowdfunding plugin \<= 2.1.15 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-1508](https://cve.now/CVE-2025-1508.md): WP Crowdfunding \<= 2.1.14 - Missing Authorization to Authenticated (Subscriber+) Post Content Download (CVSS 5.3)
- [CVE-2024-13228](https://cve.now/CVE-2024-13228.md): Qubely – Advanced Gutenberg Blocks \<= 1.8.13 - Authenticated (Contributor+) Sensitive Information Exposure via qubely\_get\_content (CVSS 4.3)
- [CVE-2025-26767](https://cve.now/CVE-2025-26767.md): WordPress Qubely plugin \<= 1.8.12 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-9601](https://cve.now/CVE-2024-9601.md): Qubely – Advanced Gutenberg Blocks \<= 1.8.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' and 'UniqueID' (CVSS 6.5)
- [CVE-2024-54282](https://cve.now/CVE-2024-54282.md): WordPress WP Mega Menu plugin \<= 1.4.2 - PHP Object Injection vulnerability (CVSS 7.2)
- [CVE-2023-41870](https://cve.now/CVE-2023-41870.md): WordPress WP Crowdfunding plugin \<= 2.1.5 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2024-11910](https://cve.now/CVE-2024-11910.md): WP Crowdfunding \<= 2.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-11911](https://cve.now/CVE-2024-11911.md): WP Crowdfunding \<= 2.1.12 - Missing Authorization to Authenticated (Subscriber+) WooCommerce Installation (CVSS 4.3)
- [CVE-2024-53816](https://cve.now/CVE-2024-53816.md): WordPress Tutor LMS Elementor Addons plugin \<= 2.1.5 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2024-10400](https://cve.now/CVE-2024-10400.md): Tutor LMS \<= 2.7.6 - Unauthenticated SQL Injection via rating\_filter (CVSS 7.5)
- [CVE-2024-10393](https://cve.now/CVE-2024-10393.md): Tutor LMS \<= 2.7.6 - User Registration Setting Bypass to Unauthorized User Registration (CVSS 5.3)
- [CVE-2024-10897](https://cve.now/CVE-2024-10897.md): Tutor LMS Elementor Addons \<= 2.1.5 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation (CVSS 4.3)
- [CVE-2024-43142](https://cve.now/CVE-2024-43142.md): WordPress Tutor LMS plugin \<= 2.7.3 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2024-43937](https://cve.now/CVE-2024-43937.md): WordPress WP Crowdfunding plugin \<= 2.1.10 - Settings Change vulnerability (CVSS 6.4)
- [CVE-2024-10117](https://cve.now/CVE-2024-10117.md): WP Crowdfunding \<= 2.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpcf\_donate Shortcode (CVSS 6.4)
- [CVE-2023-2919](https://cve.now/CVE-2023-2919.md): Tutor LMS \<= 2.7.4 - Cross-Site Request Forgery via 'addon\_enable\_disable' (CVSS 4.3)
- [CVE-2024-5784](https://cve.now/CVE-2024-5784.md): Tutor LMS Pro \<= 2.7.2 - Missing Authorization to Authenticated (Subscriber+) Insecure Direct Object Reference (CVSS 7.1)
- [CVE-2024-43955](https://cve.now/CVE-2024-43955.md): WordPress Droip plugin \<= 1.1.1 - Unauthenticated Arbitrary File Download/Deletion vulnerability (CVSS 10.0)
- [CVE-2024-43954](https://cve.now/CVE-2024-43954.md): WordPress Droip plugin \<= 1.1.1 - Subscriber+ Settings Change/Data Exposure Vulnerability (CVSS 6.3)
- [CVE-2024-39645](https://cve.now/CVE-2024-39645.md): WordPress Tutor LMS plugin \<= 2.7.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4)
- [CVE-2024-5576](https://cve.now/CVE-2024-5576.md): Tutor LMS Elementor Addons \<= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Course Carousel Widget (CVSS 6.4)
- [CVE-2024-43282](https://cve.now/CVE-2024-43282.md): WordPress Tutor LMS plugin \<= 2.7.2 - SQL Injection vulnerability (CVSS 7.6)
- [CVE-2024-43231](https://cve.now/CVE-2024-43231.md): WordPress Tutor LMS plugin \<= 2.7.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-1798](https://cve.now/CVE-2024-1798.md): Tutor LMS – Migration Tool \<= 2.2.0 - Missing Authorization in tutor\_lp\_export\_xml (CVSS 5.3)
- [CVE-2024-1804](https://cve.now/CVE-2024-1804.md): Tutor LMS – Migration Tool \<= 2.2.0 - Missing Authorization in tutor\_import\_from\_xml (CVSS 4.3)
- [CVE-2024-37947](https://cve.now/CVE-2024-37947.md): WordPress Tutor LMS plugin \<= 2.7.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2024-37266](https://cve.now/CVE-2024-37266.md): WordPress Tutor LMS plugin \<= 2.7.1 - Path Traversal vulnerability (CVSS 4.9)
- [CVE-2024-37256](https://cve.now/CVE-2024-37256.md): WordPress Tutor LMS plugin \<= 2.7.1 - SQL Injection vulnerability (CVSS 7.6)
- [CVE-2023-25799](https://cve.now/CVE-2023-25799.md): WordPress Tutor LMS plugin \<= 2.1.8 - Multiple Broken Access Control vulnerabilities (CVSS 8.3)
- [CVE-2024-5438](https://cve.now/CVE-2024-5438.md): Tutor LMS – eLearning and online course solution \<= 2.7.1 - Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Quiz Attempt Deletion (CVSS 4.3)
- [CVE-2024-4902](https://cve.now/CVE-2024-4902.md): Tutor LMS – eLearning and online course solution \<= 2.7.1 -Authenticated (Administrator+) SQL Injection (CVSS 7.2)
- [CVE-2024-4352](https://cve.now/CVE-2024-4352.md): Tutor LMS Pro \<= 2.7.0 - Missing Authorization to SQL Injection (CVSS 8.8)
- [CVE-2024-4222](https://cve.now/CVE-2024-4222.md): Tutor LMS Pro \<= 2.7.0 - Missing Authorization (CVSS 7.3)
- [CVE-2024-4351](https://cve.now/CVE-2024-4351.md): Tutor LMS Pro \<= 2.7.0 - Missing Authorization to Privilege Escalation (CVSS 8.8)
- [CVE-2024-4223](https://cve.now/CVE-2024-4223.md): Tutor LMS \<= 2.7.0 - Missing Authorization (CVSS 9.8)
- [CVE-2024-4318](https://cve.now/CVE-2024-4318.md): Tutor LMS \<= 2.7.0 - Authenticated (Instructor+) SQL Injection (CVSS 8.8)
- [CVE-2024-4279](https://cve.now/CVE-2024-4279.md): Tutor LMS – eLearning and online course solution \<= 2.7.0 - Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Course Deletion (CVSS 6.5)
- [CVE-2024-3553](https://cve.now/CVE-2024-3553.md): Tutor LMS \<= 2.6.2 - Missing Authorization to Unauthenticated Limited Options Update (CVSS 6.5)
- [CVE-2024-3994](https://cve.now/CVE-2024-3994.md): Tutor LMS – eLearning and online course solution \<= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tutor\_instructor\_list' Shortcode (CVSS 5.4)
- [CVE-2024-29913](https://cve.now/CVE-2024-29913.md): WordPress Tutor LMS Elementor Addons plugin \<= 2.1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-1751](https://cve.now/CVE-2024-1751.md): Tutor LMS – eLearning and online course solution \<= 2.6.1 - Authenticated (Subscriber+) SQL Injection (CVSS 8.8)
- [CVE-2024-1502](https://cve.now/CVE-2024-1502.md): Tutor LMS – eLearning and online course solution \<= 2.6.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion (CVSS 5.4)
- [CVE-2024-1503](https://cve.now/CVE-2024-1503.md): Tutor LMS – eLearning and online course solution \<= 2.6.1 - Cross-Site Request Forgery to Plugin Deactivation and Data Erase (CVSS 4.3)
- [CVE-2024-1133](https://cve.now/CVE-2024-1133.md): Tutor LMS \<= 2.6.0 - Missing Authorization (CVSS 4.3)
- [CVE-2024-1128](https://cve.now/CVE-2024-1128.md): Tutor LMS \<= 2.6.0 - Authenticated(Student+) HTML Injection via Q&A (CVSS 5.4)
- [CVE-2023-50859](https://cve.now/CVE-2023-50859.md): WordPress WP Crowdfunding Plugin \<= 2.1.6 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5)
- [CVE-2023-49829](https://cve.now/CVE-2023-49829.md): WordPress Tutor LMS Plugin \<= 2.2.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9)
- [CVE-2023-47532](https://cve.now/CVE-2023-47532.md): WordPress WP Crowdfunding Plugin \<= 2.1.6 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.8)
- [CVE-2023-25700](https://cve.now/CVE-2023-25700.md): WordPress Tutor LMS Plugin \<= 2.1.10 is vulnerable to SQL Injection (CVSS 8.2)
- [CVE-2023-25800](https://cve.now/CVE-2023-25800.md): WordPress Tutor LMS Plugin \<= 2.2.0 is vulnerable to SQL Injection (CVSS 8.1)
- [CVE-2023-25990](https://cve.now/CVE-2023-25990.md): WordPress Tutor LMS Plugin \<= 2.1.10 is vulnerable to SQL Injection (CVSS 7.1)
- [CVE-2022-40963](https://cve.now/CVE-2022-40963.md): WordPress WP Page Builder plugin \<= 1.2.6 - Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilities (CVSS 4.8)
- [CVE-2021-24242](https://cve.now/CVE-2021-24242.md): Tutor LMS \< 1.8.8 - Authenticated Local File Inclusion (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/themeum
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.