Themeum vulnerabilities
146 CVEs and advisories name Themeum as an affected vendor, newest first. Follow it as a feed.
- CVE-2025-6184Tutor LMS Pro – eLearning and online course solution <= 3.7.0 - Authenticated (Tutor Instructor+) SQL Injection
- CVE-2025-32230WordPress Tutor LMS plugin <= 3.4.0 - HTML Injection vulnerability
- CVE-2025-31892WordPress WP Crowdfunding plugin <= 2.1.15 - Cross Site Scripting (XSS) vulnerability
- CVE-2025-1508WP Crowdfunding <= 2.1.14 - Missing Authorization to Authenticated (Subscriber+) Post Content Download
- CVE-2024-13228Qubely – Advanced Gutenberg Blocks <= 1.8.13 - Authenticated (Contributor+) Sensitive Information Exposure via qubely_get_content
- CVE-2025-26767WordPress Qubely plugin <= 1.8.12 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-9601Qubely – Advanced Gutenberg Blocks <= 1.8.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' and 'UniqueID'
- CVE-2024-54282WordPress WP Mega Menu plugin <= 1.4.2 - PHP Object Injection vulnerability
- CVE-2023-41870WordPress WP Crowdfunding plugin <= 2.1.5 - Broken Access Control vulnerability
- CVE-2024-11910WP Crowdfunding <= 2.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11911WP Crowdfunding <= 2.1.12 - Missing Authorization to Authenticated (Subscriber+) WooCommerce Installation
- CVE-2024-53816WordPress Tutor LMS Elementor Addons plugin <= 2.1.5 - Broken Access Control vulnerability
- CVE-2024-10400Tutor LMS <= 2.7.6 - Unauthenticated SQL Injection via rating_filter
- CVE-2024-10393Tutor LMS <= 2.7.6 - User Registration Setting Bypass to Unauthorized User Registration
- CVE-2024-10897Tutor LMS Elementor Addons <= 2.1.5 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation
- CVE-2024-43142WordPress Tutor LMS plugin <= 2.7.3 - Broken Access Control vulnerability
- CVE-2024-43937WordPress WP Crowdfunding plugin <= 2.1.10 - Settings Change vulnerability
- CVE-2024-10117WP Crowdfunding <= 2.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpcf_donate Shortcode
- CVE-2023-2919Tutor LMS <= 2.7.4 - Cross-Site Request Forgery via 'addon_enable_disable'
- CVE-2024-5784Tutor LMS Pro <= 2.7.2 - Missing Authorization to Authenticated (Subscriber+) Insecure Direct Object Reference
- CVE-2024-43955WordPress Droip plugin <= 1.1.1 - Unauthenticated Arbitrary File Download/Deletion vulnerability
- CVE-2024-43954WordPress Droip plugin <= 1.1.1 - Subscriber+ Settings Change/Data Exposure Vulnerability
- CVE-2024-39645WordPress Tutor LMS plugin <= 2.7.2 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-5576Tutor LMS Elementor Addons <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Course Carousel Widget
- CVE-2024-43282WordPress Tutor LMS plugin <= 2.7.2 - SQL Injection vulnerability
- CVE-2024-43231WordPress Tutor LMS plugin <= 2.7.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-1798Tutor LMS – Migration Tool <= 2.2.0 - Missing Authorization in tutor_lp_export_xml
- CVE-2024-1804Tutor LMS – Migration Tool <= 2.2.0 - Missing Authorization in tutor_import_from_xml
- CVE-2024-37947WordPress Tutor LMS plugin <= 2.7.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-37266WordPress Tutor LMS plugin <= 2.7.1 - Path Traversal vulnerability