Login Request a demo
TH
Vendor
themeum
18 products with CVEs on record
195
CVEs
0
On KEV
17
New 30D
Products
KF
Kirki – Freeform Page Builder, Website Builder & Customizer
themeum
9.8
19 CVEs0 on KEV6 new
TL
Tutor LMS – eLearning and online course solution
themeum
9.8
46 CVEs0 on KEV4 new
TL
Tutor LMS
Themeum
9.8
60 CVEs0 on KEV3 new
KI
Kirki
Themeum
9.8
10 CVEs0 on KEV2 new
WC
WP Crowdfunding
themeum
8.8
16 CVEs0 on KEV2 new
QU
Qubely
Themeum
7.5
10 CVEs0 on KEV0 new
TL
Tutor LMS Pro
themeum
9.8
9 CVEs0 on KEV0 new
TL
Tutor LMS Elementor Addons
themeum
8.8
6 CVEs0 on KEV0 new
DR
Droip
Themeum
8.8
4 CVEs0 on KEV0 new
WP
WP Page Builder
Themeum
5.4
4 CVEs0 on KEV0 new
QA
Qubely – Advanced Gutenberg Blocks
themeum
6.5
2 CVEs0 on KEV0 new
TL
Tutor LMS – Migration Tool
themeum
5.3
2 CVEs0 on KEV0 new
WM
WP Mega Menu
Themeum
7.6
2 CVEs0 on KEV0 new
RW
Right Way
Themeum
8.1
1 CVEs0 on KEV0 new
SK
Skillate
Themeum
7.1
1 CVEs0 on KEV0 new
TL
Tutor LMS BunnyNet Integration
Themeum
5.9
1 CVEs0 on KEV0 new
TU
Tutorlms-migrationtool
Themeum
5.3
1 CVEs0 on KEV0 new
WP
WP Page Builder (WordPress plugin)
Themeum
5.4
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-118083
New
WC
WP Crowdfunding
Themeum
7.5–Oct 29WordPress WP Crowdfunding plugin <= 2.2.2 - Sensitive Data Exposure vulnerability
CVE-2026-42692
New
WC
WP Crowdfunding
Themeum
7.1–Oct 29WordPress WP Crowdfunding plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability
CVE-2026-42694
New
KI
Kirki
Themeum
4.3–Oct 29WordPress Kirki plugin <= 6.4.0 - Content Injection vulnerability
CVE-2026-75891
New
KF
Kirki – Freeform Page Builder, Website Builder & Customizer
themeum
8.8
0%
Oct 27Kirki <= 6.2.5 - Authenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover via 'get-single-symbol' AJAX Endpoint
CVE-2026-111407
TL
Tutor LMS
Themeum
6.5
0%
Oct 19WordPress Tutor LMS plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerability
CVE-2026-92715
TL
Tutor LMS – eLearning and online course solution
themeum
4.3
0%
Oct 17Tutor LMS <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover via 'ID' Parameter
CVE-2026-104734
KF
Kirki – Freeform Page Builder, Website Builder & Customizer
themeum
7.2
0%
Oct 17Kirki <= 6.3.2 - Authenticated (Administrator+) PHP Object Injection via Deserialization of Untrusted Input via ZIP Template Import
CVE-2026-107762
KF
Kirki – Freeform Page Builder, Website Builder & Customizer
themeum
7.5
0%
Oct 17Kirki <= 6.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via 'context' Parameter
CVE-2026-93681
TL
Tutor LMS – eLearning and online course solution
themeum
6.4
0%
Oct 16Tutor LMS <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name Parameter
CVE-2026-88963
TL
Tutor LMS – eLearning and online course solution
themeum
6.1
0%
Oct 16Tutor LMS <= 4.0.8 - Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting via 'redirect_url' Parameter
CVE-2026-14572
KF
Kirki – Freeform Page Builder, Website Builder & Customizer
themeum
6.4
0%
Oct 15Kirki <= 6.2.0 - Authenticated (Custom+) Stored Cross-Site Scripting via Page Builder Text Content
CVE-2026-100193
TL
Tutor LMS – eLearning and online course solution
themeum
4.7
0%
Oct 14Tutor LMS <= 4.1.0 - Reflected Cross-Site Scripting via 'tab' Parameter
CVE-2026-42702
TL
Tutor LMS
Themeum
7.1
0%
Oct 10WordPress Tutor LMS plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability
CVE-2026-102291
KF
Kirki – Freeform Page Builder, Website Builder & Customizer
themeum
5.4
0%
Oct 10Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'display_name'
CVE-2026-42698
TL
Tutor LMS
Themeum
5.3
0%
Oct 8WordPress Tutor LMS plugin <= 4.1.1 - Race Condition vulnerability
CVE-2026-102173
KF
Kirki – Freeform Page Builder, Website Builder & Customizer
themeum
7.2
0%
Oct 7Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Unauthenticated Stored Cross-Site Scripting via Registration Metadata
CVE-2026-103065
KI
Kirki
Themeum
8.2
0%
Oct 3WordPress Kirki plugin <= 6.3.1 - Arbitrary Code Execution vulnerability
CVE-2026-18335
KF
Kirki – Freeform Page Builder, Website Builder & Customizer
themeum
5.4
0%
Sep 24Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Unauthenticated Blind Server-Side Request Forgery via 'kirki_data' Parameter
CVE-2026-18439
TL
Tutor LMS – eLearning and online course solution
themeum
4.3
0%
Sep 22Tutor LMS <= 4.0.7 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via 'payload' Parameter
CVE-2026-89081
TL
Tutor LMS – eLearning and online course solution
themeum
6.1
0%
Sep 19Tutor LMS <= 4.0.8 - Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters
CVE-2026-88944
TL
Tutor LMS – eLearning and online course solution
themeum
4.3
0%
Sep 19Tutor LMS <= 4.0.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id' Parameter
CVE-2026-89333
TL
Tutor LMS – eLearning and online course solution
themeum
6.5
0%
Sep 19Tutor LMS <= 4.0.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameter
CVE-2026-92465
WM
WP Mega Menu
Themeum
7.6
0%
Sep 16WordPress WP Mega Menu plugin <= 1.4.2 - SQL Injection vulnerability
CVE-2026-78175
TL
Tutor LMS – eLearning and online course solution
themeum
8.8
1%
Sep 12Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution
CVE-2026-17037
KF
Kirki – Freeform Page Builder, Website Builder & Customizer
themeum
7.2
0%
Sep 11Kirki <= 6.2.0 - Unauthenticated Stored Cross-Site Scripting via 'comment' Parameter
CVE-2026-19945
WC
WP Crowdfunding
themeum
6.4
0%
Sep 9WP Crowdfunding <= 2.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'first_name' Parameter
CVE-2026-19944
WC
WP Crowdfunding
themeum
4.9
0%
Sep 9WP Crowdfunding <= 2.2.1 - Authenticated (Shop Manager+) SQL Injection via 'wpneo_reward' Post Meta
CVE-2026-16759
TL
Tutor LMS – eLearning and online course solution
themeum
6.5
1%
Aug 28Tutor LMS <= 4.0.5 - Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters
CVE-2026-66629
KI
Kirki
Themeum
7.1
0%
Aug 18WordPress Kirki plugin <= 6.2.3 - Cross Site Scripting (XSS) vulnerability
CVE-2026-18347
KF
Kirki – Freeform Page Builder, Website Builder & Customizer
themeum
4.3
1%
Aug 16Kirki <= 6.1.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'context' Parameter
CVE-2026-17604
KF
Kirki – Freeform Page Builder, Website Builder & Customizer
themeum
4.9
1%
Aug 16Kirki <= 6.1.1 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameter
CVE-2026-16974
KF
Kirki – Freeform Page Builder, Website Builder & Customizer
themeum
6.4
0%
Aug 11Kirki - Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_meta Shortcode
CVE-2026-15601
KF
Kirki – Freeform Page Builder, Website Builder & Customizer
themeum
4.9
1%
Aug 1Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip)
CVE-2026-15444
TL
Tutor LMS – eLearning and online course solution
themeum
4.9
0%
Jul 28Tutor LMS <= 4.0.1 - Authenticated (Administrator+) SQL Injection via 'coupon_code' Parameter
CVE-2026-65436
KI
Kirki
Themeum
6.8
1%
Jul 27WordPress Kirki plugin <= 6.0.13 - Arbitrary File Deletion vulnerability
CVE-2026-13464
KF
Kirki – Freeform Page Builder, Website Builder & Customizer
themeum
5.3
0%
Jul 24Kirki <= 6.0.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'context' Parameter
CVE-2026-65531
QU
Qubely
Themeum
4.8
0%
Jul 23WordPress Qubely plugin <= 1.8.14 - Broken Access Control vulnerability
CVE-2026-1372
TL
Tutor LMS Elementor Addons
themeum
4.3
0%
Jul 21Tutor LMS Elementor Addons <= 4.0.0 - Missing Authorization to Authenticated (Subscriber+) Tutor LMS and Elementor Plugin Activation
CVE-2026-15457
KF
Kirki – Freeform Page Builder, Website Builder & Customizer
themeum
4.9
1%
Jul 17Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary Directory Deletion via 'family' Parameter
CVE-2026-15022
TL
Tutor LMS – eLearning and online course solution
themeum
6.5
1%
Jul 16Tutor LMS <= 4.0.0 - Authenticated (Subscriber+) SQL Injection via Stored Quiz Answer Array
CVE-2026-57724
KI
Kirki
Themeum
9.8
1%
Jul 13WordPress Kirki plugin <= 6.0.12 - PHP Object Injection vulnerability
CVE-2026-57725
KI
Kirki
Themeum
7.1
0%
Jul 13WordPress Kirki plugin <= 6.0.11 - Cross Site Scripting (XSS) vulnerability
CVE-2026-57726
KI
Kirki
Themeum
9.3
0%
Jul 13WordPress Kirki plugin <= 6.0.12 - SQL Injection vulnerability
CVE-2026-57727
KI
Kirki
Themeum
7.5
0%
Jul 13WordPress Kirki plugin <= 6.2.0 - Broken Access Control vulnerability
CVE-2026-57694
TL
Tutor LMS
Themeum
6.5
0%
Jul 13WordPress Tutor LMS plugin <= 3.9.13 - Insecure Direct Object References (IDOR) vulnerability
CVE-2026-57680
KI
Kirki
Themeum
6.5
0%
Jul 2WordPress Kirki plugin <= 6.0.11 - Insecure Direct Object References (IDOR) vulnerability
CVE-2026-12472
KF
Kirki – Freeform Page Builder, Website Builder & Customizer
themeum
5.3
1%
Jul 2Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Arbitrary Email Content Injection (Mail Relay / Phishing) via 'emailBody' and 'emailSubject' Parameters
CVE-2026-12122
KF
Kirki – Freeform Page Builder, Website Builder & Customizer
themeum
5.3
0%
Jul 2Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via kirki_post_apis_nopriv AJAX Action
CVE-2026-13443
TL
Tutor LMS – eLearning and online course solution
themeum
6.4
0%
Jul 1Tutor LMS <= 3.9.13 - Authenticated (Author+) Stored Cross-Site Scripting via Lesson Attachment Title
CVE-2026-57627
KI
Kirki
Themeum
4.9
0%
Jun 26WordPress Kirki plugin <= 6.0.11 - Server Side Request Forgery (SSRF) vulnerability
CVE-2026-10736
TL
Tutor LMS – eLearning and online course solution
themeum
4.9
0%
Jun 18Tutor LMS <= 3.9.11 - Authenticated (Administrator+) SQL Injection via 'data' Parameter
CVE-2026-22332
TL
Tutor LMS Pro
Themeum
9.3
0%
Jun 17WordPress Tutor LMS Pro plugin <= 3.9.6 - SQL Injection vulnerability
CVE-2026-22330
RW
Right Way
Themeum
8.1
0%
Jun 17WordPress Right Way theme <= 4.0 - Local File Inclusion vulnerability
CVE-2026-22329
SK
Skillate
Themeum
7.1
0%
Jun 17WordPress Skillate theme <= 1.2.10 - Reflected Cross Site Scripting (XSS) vulnerability
CVE-2026-40743
TL
Tutor LMS
Themeum
6.5
0%
Jun 15WordPress Tutor LMS plugin <= 3.9.7 - Broken Access Control vulnerability
CVE-2026-8206
KF
Kirki – Freeform Page Builder, Website Builder & Customizer
themeum
9.8
1%
Jun 2Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'
CVE-2026-8073
KF
Kirki – Freeform Page Builder, Website Builder & Customizer
themeum
7.5
1%
May 19Kirki <= 6.0.6 - Unauthenticated Limited Arbitrary File Read and Deletion via downloadZIP
CVE-2026-8096
KF
Kirki – Freeform Page Builder, Website Builder & Customizer
themeum
6.5
0%
May 19Kirki <= 6.0.6 - Missing Authorization to Authenticated (Subscriber+) Sensitive Form Submission Data Exposure via 'kirki_wp_admin_get_apis' Action
CVE-2026-6965
TL
Tutor LMS – eLearning and online course solution
themeum
5.3
0%
May 13Tutor LMS <= 3.9.9 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Post Deletion via 'course' GET Parameter
CVE-2026-5502
TL
Tutor LMS – eLearning and online course solution
themeum
5.3
0%
Apr 17Tutor LMS <= 3.9.8 - Authenticated (Subscriber+) Arbitrary Course Content Manipulation via tutor_update_course_content_order