Themeum vulnerabilities
146 CVEs and advisories name Themeum as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-8096Kirki <= 6.0.6 - Missing Authorization to Authenticated (Subscriber+) Sensitive Form Submission Data Exposure via 'kirki_wp_admin_get_apis' Action
- CVE-2026-6965Tutor LMS <= 3.9.9 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Post Deletion via 'course' GET Parameter
- CVE-2026-5502Tutor LMS <= 3.9.8 - Authenticated (Subscriber+) Arbitrary Course Content Manipulation via tutor_update_course_content_order
- CVE-2026-6080Tutor LMS <= 3.9.8 - Authenticated (Admin+) SQL Injection via 'date' Parameter
- CVE-2026-40740WordPress Tutor LMS plugin <= 3.9.7 - Broken Access Control vulnerability
- CVE-2026-3371Tutor LMS <= 3.9.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Course Content Modification
- CVE-2026-3358Tutor LMS <= 3.9.7 - Missing Authorization to Authenticated (Subscriber+) Unauthorized Private Course Enrollment
- CVE-2026-3360Tutor LMS <= 3.9.7 - Missing Authorization to Unauthenticated Arbitrary Billing Profile Overwrite via 'order_id' Parameter
- CVE-2026-39638WordPress Qubely plugin <= 1.8.14 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-25406WordPress Tutor LMS Pro plugin <= 3.9.4 - Broken Authentication vulnerability
- CVE-2025-32223WordPress Tutor LMS plugin <= 3.9.4 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-0953Tutor LMS Pro <= 3.9.5 - Authentication Bypass via Social Login
- CVE-2026-23799WordPress Tutor LMS plugin <= 3.9.5 - Broken Access Control vulnerability
- CVE-2025-13673Tutor LMS <= 3.9.6 - Unauthenticated SQL Injection via coupon_code
- CVE-2026-1371Tutor LMS <= 3.9.5 - Authenticated (Subscriber+) Information Disclosure in Coupon Details via 'tutor_coupon_details' AJAX Action
- CVE-2026-1375Tutor LMS <= 3.9.5 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Course Modification and Deletion
- CVE-2026-24584WordPress Tutor LMS BunnyNet Integration plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2025-47555WordPress Tutor LMS plugin <= 3.9.4 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-0548Tutor LMS – eLearning and online course solution <= 3.9.4 - Missing Authorization to Authenticated (Subscriber+) Limited Attachment Deletion
- CVE-2025-13935Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Course Completion
- CVE-2025-13934Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Course Enrollment Bypass
- CVE-2025-13628Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Coupon Modification
- CVE-2025-13679Tutor LMS <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via tutor_order_details
- CVE-2025-63042WordPress Tutor LMS Elementor Addons plugin <= 3.0.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2025-6639Tutor LMS Pro – eLearning and online course solution <= 3.8.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to View/Edit Other Assignments
- CVE-2025-11564Tutor LMS – eLearning and online course solution <= 3.8.3 - Missing Authorization to Unauthenticated Payment Status Update
- CVE-2025-6680Tutor LMS <= 3.8.3 - Missing Authorization to Sensitive Information Exposure
- CVE-2025-58249WordPress Qubely Plugin <= 1.8.14 - Sensitive Data Exposure Vulnerability
- CVE-2025-58663WordPress Qubely Plugin <= 1.8.14 - Broken Access Control Vulnerability
- CVE-2025-58993WordPress Tutor LMS Plugin <= 3.7.4 - SQL Injection Vulnerability