Login Request a demo
TH
Vendor
Themeum
15 products with CVEs on record
164
CVEs
0
On KEV
14
New 30D
Products
KF
Kirki – Freeform Page Builder, Website Builder & Customizer
themeum
9.8
19 CVEs0 on KEV6 new
TL
Tutor LMS
Themeum
9.8
58 CVEs0 on KEV3 new
TL
Tutor LMS – eLearning and online course solution
themeum
8.8
31 CVEs0 on KEV4 new
KI
Kirki
Themeum
9.8
9 CVEs0 on KEV1 new
WC
WP Crowdfunding
themeum
8.8
13 CVEs0 on KEV0 new
QU
Qubely
Themeum
7.5
10 CVEs0 on KEV0 new
TL
Tutor LMS Elementor Addons
themeum
8.8
6 CVEs0 on KEV0 new
DR
Droip
Themeum
8.8
4 CVEs0 on KEV0 new
TL
Tutor LMS Pro
themeum
9.8
4 CVEs0 on KEV0 new
WP
WP Page Builder
Themeum
5.4
4 CVEs0 on KEV0 new
TL
Tutor Lms - Migration Tool
Themeum
5.3
2 CVEs0 on KEV0 new
RW
Right Way
Themeum
8.1
1 CVEs0 on KEV0 new
SK
Skillate
Themeum
7.1
1 CVEs0 on KEV0 new
TL
Tutor LMS BunnyNet Integration
Themeum
5.9
1 CVEs0 on KEV0 new
WM
WP Mega Menu
Themeum
7.6
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-75891
New
KF
Kirki – Freeform Page Builder, Website Builder & Customizer
themeum
8.8
0%
Oct 27Kirki <= 6.2.5 - Authenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover via 'get-single-symbol' AJAX Endpoint
CVE-2026-111407
TL
Tutor LMS
Themeum
6.5
0%
Oct 19WordPress Tutor LMS plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerability
CVE-2026-92715
TL
Tutor LMS – eLearning and online course solution
themeum
4.3
0%
Oct 17Tutor LMS <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover via 'ID' Parameter
CVE-2026-104734
KF
Kirki – Freeform Page Builder, Website Builder & Customizer
themeum
7.2
0%
Oct 17Kirki <= 6.3.2 - Authenticated (Administrator+) PHP Object Injection via Deserialization of Untrusted Input via ZIP Template Import
CVE-2026-107762
KF
Kirki – Freeform Page Builder, Website Builder & Customizer
themeum
7.5
0%
Oct 17Kirki <= 6.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via 'context' Parameter
CVE-2026-93681
TL
Tutor LMS – eLearning and online course solution
themeum
6.4
0%
Oct 16Tutor LMS <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name Parameter
CVE-2026-88963
TL
Tutor LMS – eLearning and online course solution
themeum
6.1
0%
Oct 16Tutor LMS <= 4.0.8 - Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting via 'redirect_url' Parameter
CVE-2026-14572
KF
Kirki – Freeform Page Builder, Website Builder & Customizer
themeum
6.4
0%
Oct 15Kirki <= 6.2.0 - Authenticated (Custom+) Stored Cross-Site Scripting via Page Builder Text Content
CVE-2026-100193
TL
Tutor LMS – eLearning and online course solution
themeum
4.7
0%
Oct 14Tutor LMS <= 4.1.0 - Reflected Cross-Site Scripting via 'tab' Parameter
CVE-2026-42702
TL
Tutor LMS
Themeum
7.1
0%
Oct 10WordPress Tutor LMS plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability
CVE-2026-102291
KF
Kirki – Freeform Page Builder, Website Builder & Customizer
themeum
5.4
0%
Oct 10Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'display_name'
CVE-2026-42698
TL
Tutor LMS
Themeum
5.3
0%
Oct 8WordPress Tutor LMS plugin <= 4.1.1 - Race Condition vulnerability
CVE-2026-102173
KF
Kirki – Freeform Page Builder, Website Builder & Customizer
themeum
7.2
0%
Oct 7Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Unauthenticated Stored Cross-Site Scripting via Registration Metadata
CVE-2026-103065
KI
Kirki
Themeum
8.2
0%
Oct 3WordPress Kirki plugin <= 6.3.1 - Arbitrary Code Execution vulnerability
CVE-2026-18335
KF
Kirki – Freeform Page Builder, Website Builder & Customizer
themeum
5.4
0%
Sep 24Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Unauthenticated Blind Server-Side Request Forgery via 'kirki_data' Parameter
CVE-2026-18439
TL
Tutor LMS – eLearning and online course solution
themeum
4.3
0%
Sep 22Tutor LMS <= 4.0.7 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via 'payload' Parameter
CVE-2026-89081
TL
Tutor LMS – eLearning and online course solution
themeum
6.1
0%
Sep 19Tutor LMS <= 4.0.8 - Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters
CVE-2026-88944
TL
Tutor LMS – eLearning and online course solution
themeum
4.3
0%
Sep 19Tutor LMS <= 4.0.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id' Parameter
CVE-2026-89333
TL
Tutor LMS – eLearning and online course solution
themeum
6.5
0%
Sep 19Tutor LMS <= 4.0.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameter
CVE-2026-92465
WM
WP Mega Menu
Themeum
7.6
0%
Sep 16WordPress WP Mega Menu plugin <= 1.4.2 - SQL Injection vulnerability
CVE-2026-78175
TL
Tutor LMS – eLearning and online course solution
themeum
8.8
1%
Sep 12Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution
CVE-2026-17037
KF
Kirki – Freeform Page Builder, Website Builder & Customizer
themeum
7.2
0%
Sep 11Kirki <= 6.2.0 - Unauthenticated Stored Cross-Site Scripting via 'comment' Parameter
CVE-2026-19945
WC
WP Crowdfunding
themeum
6.4
0%
Sep 9WP Crowdfunding <= 2.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'first_name' Parameter
CVE-2026-19944
WC
WP Crowdfunding
themeum
4.9
0%
Sep 9WP Crowdfunding <= 2.2.1 - Authenticated (Shop Manager+) SQL Injection via 'wpneo_reward' Post Meta
CVE-2026-16759
TL
Tutor LMS – eLearning and online course solution
themeum
6.5
1%
Aug 28Tutor LMS <= 4.0.5 - Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters
CVE-2026-66629
KI
Kirki
Themeum
7.1
0%
Aug 18WordPress Kirki plugin <= 6.2.3 - Cross Site Scripting (XSS) vulnerability
CVE-2026-18347
KF
Kirki – Freeform Page Builder, Website Builder & Customizer
themeum
4.3
1%
Aug 16Kirki <= 6.1.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'context' Parameter
CVE-2026-17604
KF
Kirki – Freeform Page Builder, Website Builder & Customizer
themeum
4.9
1%
Aug 16Kirki <= 6.1.1 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameter
CVE-2026-16974
KF
Kirki – Freeform Page Builder, Website Builder & Customizer
themeum
6.4
0%
Aug 11Kirki - Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_meta Shortcode
CVE-2026-15601
KF
Kirki – Freeform Page Builder, Website Builder & Customizer
themeum
4.9
1%
Aug 1Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip)
CVE-2026-15444
TL
Tutor LMS – eLearning and online course solution
themeum
4.9
0%
Jul 28Tutor LMS <= 4.0.1 - Authenticated (Administrator+) SQL Injection via 'coupon_code' Parameter
CVE-2026-65436
KI
Kirki
Themeum
6.8
1%
Jul 27WordPress Kirki plugin <= 6.0.13 - Arbitrary File Deletion vulnerability
CVE-2026-13464
KF
Kirki – Freeform Page Builder, Website Builder & Customizer
themeum
5.3
0%
Jul 24Kirki <= 6.0.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'context' Parameter
CVE-2026-65531
QU
Qubely
Themeum
4.8
0%
Jul 23WordPress Qubely plugin <= 1.8.14 - Broken Access Control vulnerability
CVE-2026-1372
TL
Tutor LMS Elementor Addons
themeum
4.3
0%
Jul 21Tutor LMS Elementor Addons <= 4.0.0 - Missing Authorization to Authenticated (Subscriber+) Tutor LMS and Elementor Plugin Activation
CVE-2026-15457
KF
Kirki – Freeform Page Builder, Website Builder & Customizer
themeum
4.9
1%
Jul 17Kirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary Directory Deletion via 'family' Parameter
CVE-2026-15022
TL
Tutor LMS – eLearning and online course solution
themeum
6.5
1%
Jul 16Tutor LMS <= 4.0.0 - Authenticated (Subscriber+) SQL Injection via Stored Quiz Answer Array
CVE-2026-57724
KI
Kirki
Themeum
9.8
1%
Jul 13WordPress Kirki plugin <= 6.0.12 - PHP Object Injection vulnerability
CVE-2026-57725
KI
Kirki
Themeum
7.1
0%
Jul 13WordPress Kirki plugin <= 6.0.11 - Cross Site Scripting (XSS) vulnerability
CVE-2026-57726
KI
Kirki
Themeum
9.3
0%
Jul 13WordPress Kirki plugin <= 6.0.12 - SQL Injection vulnerability
CVE-2026-57727
KI
Kirki
Themeum
7.5
0%
Jul 13WordPress Kirki plugin <= 6.2.0 - Broken Access Control vulnerability
CVE-2026-57694
TL
Tutor LMS
Themeum
6.5
0%
Jul 13WordPress Tutor LMS plugin <= 3.9.13 - Insecure Direct Object References (IDOR) vulnerability
CVE-2026-57680
KI
Kirki
Themeum
6.5
0%
Jul 2WordPress Kirki plugin <= 6.0.11 - Insecure Direct Object References (IDOR) vulnerability
CVE-2026-12472
KF
Kirki – Freeform Page Builder, Website Builder & Customizer
themeum
5.3
1%
Jul 2Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Arbitrary Email Content Injection (Mail Relay / Phishing) via 'emailBody' and 'emailSubject' Parameters
CVE-2026-12122
KF
Kirki – Freeform Page Builder, Website Builder & Customizer
themeum
5.3
0%
Jul 2Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via kirki_post_apis_nopriv AJAX Action
CVE-2026-13443
TL
Tutor LMS – eLearning and online course solution
themeum
6.4
0%
Jul 1Tutor LMS <= 3.9.13 - Authenticated (Author+) Stored Cross-Site Scripting via Lesson Attachment Title
CVE-2026-57627
KI
Kirki
Themeum
4.9
0%
Jun 26WordPress Kirki plugin <= 6.0.11 - Server Side Request Forgery (SSRF) vulnerability
CVE-2026-10736
TL
Tutor LMS – eLearning and online course solution
themeum
4.9
0%
Jun 18Tutor LMS <= 3.9.11 - Authenticated (Administrator+) SQL Injection via 'data' Parameter
CVE-2026-22332
TL
Tutor LMS Pro
Themeum
9.3
0%
Jun 17WordPress Tutor LMS Pro plugin <= 3.9.6 - SQL Injection vulnerability
CVE-2026-22330
RW
Right Way
Themeum
8.1
0%
Jun 17WordPress Right Way theme <= 4.0 - Local File Inclusion vulnerability
CVE-2026-22329
SK
Skillate
Themeum
7.1
0%
Jun 17WordPress Skillate theme <= 1.2.10 - Reflected Cross Site Scripting (XSS) vulnerability
CVE-2026-40743
TL
Tutor LMS
Themeum
6.5
0%
Jun 15WordPress Tutor LMS plugin <= 3.9.7 - Broken Access Control vulnerability
CVE-2026-8206
KF
Kirki – Freeform Page Builder, Website Builder & Customizer
themeum
9.8
1%
Jun 2Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'
CVE-2026-8073
KF
Kirki – Freeform Page Builder, Website Builder & Customizer
themeum
7.5
1%
May 19Kirki <= 6.0.6 - Unauthenticated Limited Arbitrary File Read and Deletion via downloadZIP
CVE-2026-8096
KF
Kirki – Freeform Page Builder, Website Builder & Customizer
themeum
6.5
0%
May 19Kirki <= 6.0.6 - Missing Authorization to Authenticated (Subscriber+) Sensitive Form Submission Data Exposure via 'kirki_wp_admin_get_apis' Action
CVE-2026-6965
TL
Tutor LMS – eLearning and online course solution
themeum
5.3
0%
May 13Tutor LMS <= 3.9.9 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Post Deletion via 'course' GET Parameter
CVE-2026-5502
TL
Tutor LMS – eLearning and online course solution
themeum
5.3
0%
Apr 17Tutor LMS <= 3.9.8 - Authenticated (Subscriber+) Arbitrary Course Content Manipulation via tutor_update_course_content_order
CVE-2026-6080
TL
Tutor LMS – eLearning and online course solution
themeum
6.5
0%
Apr 17Tutor LMS <= 3.9.8 - Authenticated (Admin+) SQL Injection via 'date' Parameter
CVE-2026-40740
TL
Tutor LMS
Themeum
5.4
0%
Apr 15WordPress Tutor LMS plugin <= 3.9.7 - Broken Access Control vulnerability
CVE-2026-3371
TL
Tutor LMS – eLearning and online course solution
themeum
4.3
0%
Apr 11Tutor LMS <= 3.9.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Course Content Modification