[ Vendor · 14 CVEs ]
themeum
CVEs affecting themeum published in the last 30 days, plus any themeum CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-111407 | 19 Oct 2026 | CVSS 6.5 | Themeum Tutor LMSImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Stored XSS.This… | |
| CVE-2026-92715 | 17 Oct 2026 | CVSS 4.3 | themeum Tutor LMS – eLearning and online course solutionThe Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to… | |
| CVE-2026-107762 | 17 Oct 2026 | CVSS 7.5 | themeum Kirki – Freeform Page Builder, Website Builder & CustomizerThe Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all… | |
| CVE-2026-104734 | 17 Oct 2026 | CVSS 7.2 | themeum Kirki – Freeform Page Builder, Website Builder & CustomizerThe Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and… | |
| CVE-2026-93681 | 16 Oct 2026 | CVSS 6.4 | themeum Tutor LMS – eLearning and online course solutionThe Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via display_name Parameter in… | |
| CVE-2026-88963 | 16 Oct 2026 | CVSS 6.1 | themeum Tutor LMS – eLearning and online course solutionThe Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via the 'redirect_url'… | |
| CVE-2026-14572 | 15 Oct 2026 | CVSS 6.4 | themeum Kirki – Freeform Page Builder, Website Builder & CustomizerThe Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Page Builder… | |
| CVE-2026-100193 | 14 Oct 2026 | CVSS 4.7 | themeum Tutor LMS – eLearning and online course solutionThe Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in… | |
| CVE-2026-42702 | 10 Oct 2026 | CVSS 7.1 | Themeum Tutor LMSImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Reflected… | |
| CVE-2026-102291 | 10 Oct 2026 | CVSS 5.4 | themeum Kirki – Freeform Page Builder, Website Builder & CustomizerThe Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions… | |
| CVE-2026-42698 | 8 Oct 2026 | CVSS 5.3 | Themeum Tutor LMSConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Themeum Tutor LMS tutor allows… | |
| CVE-2026-102173 | 7 Oct 2026 | CVSS 7.2 | themeum Kirki – Freeform Page Builder, Website Builder & CustomizerThe Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via registration… | |
| CVE-2026-103065 | 3 Oct 2026 | CVSS 8.2 | Themeum KirkiImproper Validation of Specified Quantity in Input vulnerability in Themeum Kirki kirki allows Accessing Functionality Not Properly Constrained by… | |
| CVE-2026-18335 | 24 Sep 2026 | CVSS 5.4 | themeum Kirki – Freeform Page Builder, Website Builder & CustomizerThe Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all… |