Themeum vulnerabilities
146 CVEs and advisories name Themeum as an affected vendor, newest first. Follow it as a feed.
- CVE-2024-37256WordPress Tutor LMS plugin <= 2.7.1 - SQL Injection vulnerability
- CVE-2023-25799WordPress Tutor LMS plugin <= 2.1.8 - Multiple Broken Access Control vulnerabilities
- CVE-2024-5438Tutor LMS – eLearning and online course solution <= 2.7.1 - Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Quiz Attempt Deletion
- CVE-2024-4902Tutor LMS – eLearning and online course solution <= 2.7.1 -Authenticated (Administrator+) SQL Injection
- CVE-2024-4352Tutor LMS Pro <= 2.7.0 - Missing Authorization to SQL Injection
- CVE-2024-4222Tutor LMS Pro <= 2.7.0 - Missing Authorization
- CVE-2024-4351Tutor LMS Pro <= 2.7.0 - Missing Authorization to Privilege Escalation
- CVE-2024-4223Tutor LMS <= 2.7.0 - Missing Authorization
- CVE-2024-4318Tutor LMS <= 2.7.0 - Authenticated (Instructor+) SQL Injection
- CVE-2024-4279Tutor LMS – eLearning and online course solution <= 2.7.0 - Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Course Deletion
- CVE-2024-3553Tutor LMS <= 2.6.2 - Missing Authorization to Unauthenticated Limited Options Update
- CVE-2024-3994Tutor LMS – eLearning and online course solution <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tutor_instructor_list' Shortcode
- CVE-2024-29913WordPress Tutor LMS Elementor Addons plugin <= 2.1.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-1751Tutor LMS – eLearning and online course solution <= 2.6.1 - Authenticated (Subscriber+) SQL Injection
- CVE-2024-1502Tutor LMS – eLearning and online course solution <= 2.6.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion
- CVE-2024-1503Tutor LMS – eLearning and online course solution <= 2.6.1 - Cross-Site Request Forgery to Plugin Deactivation and Data Erase
- CVE-2024-1133Tutor LMS <= 2.6.0 - Missing Authorization
- CVE-2024-1128Tutor LMS <= 2.6.0 - Authenticated(Student+) HTML Injection via Q&A
- CVE-2023-50859WordPress WP Crowdfunding Plugin <= 2.1.6 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-49829WordPress Tutor LMS Plugin <= 2.2.4 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-47532WordPress WP Crowdfunding Plugin <= 2.1.6 is vulnerable to Cross Site Scripting (XSS)
- CVE-2023-25700WordPress Tutor LMS Plugin <= 2.1.10 is vulnerable to SQL Injection
- CVE-2023-25800WordPress Tutor LMS Plugin <= 2.2.0 is vulnerable to SQL Injection
- CVE-2023-25990WordPress Tutor LMS Plugin <= 2.1.10 is vulnerable to SQL Injection
- CVE-2022-40963WordPress WP Page Builder plugin <= 1.2.6 - Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilities
- CVE-2021-24242Tutor LMS < 1.8.8 - Authenticated Local File Inclusion