Log in Start free

Themeum

Products

ProductCVEsExploitedLatest
Tutor LMS – eLearning and online course solution47–Oct 17, 2026
Tutor LMS22–Oct 19, 2026
Kirki – Freeform Page Builder, Website Builder & Customizer19–Oct 27, 2026
WP Crowdfunding13–Oct 29, 2026
Kirki12–Oct 30, 2026
Tutor LMS Pro9–Jun 17, 2026
Tutor LMS Elementor Addons6–Jul 21, 2026
Qubely5–Jul 23, 2026
Droip2–Aug 29, 2024
Qubely – Advanced Gutenberg Blocks2–Mar 11, 2025
Tutor LMS – Migration Tool2–Jul 27, 2024
WP Mega Menu2–Sep 16, 2026
Skillate1–Jun 17, 2026
Right Way1–Jun 17, 2026
WP Page Builder (WordPress plugin)1–Nov 18, 2022
Tutor LMS BunnyNet Integration1–Jan 23, 2026

Exploited and recent CVEs

  • CVE-2026-112348 Medium 6.5 Kirki WordPress Plugin < 6.2.5 reCAPTCHA Bypass via Missing Token 0.3%
  • CVE-2026-112347 High 7.6 Kirki WordPress Plugin < 6.4.1 Broken Object-Level Access Control via Page API 0.3%
  • CVE-2026-118083 High 7.5 WordPress WP Crowdfunding plugin <= 2.2.2 - Sensitive Data Exposure vulnerability 0.3%
  • CVE-2026-42692 High 7.1 WordPress WP Crowdfunding plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-42694 Medium 4.3 WordPress Kirki plugin <= 6.4.0 - Content Injection vulnerability 0.2%
  • CVE-2026-75891 High 8.8 Kirki <= 6.2.5 - Authenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover via 'get-single-symbol' AJAX Endpoint 0.3%
  • CVE-2026-111407 Medium 6.5 WordPress Tutor LMS plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-92715 Medium 4.3 Tutor LMS <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover via 'ID' Parameter 0.2%
  • CVE-2026-104734 High 7.2 Kirki <= 6.3.2 - Authenticated (Administrator+) PHP Object Injection via Deserialization of Untrusted Input via ZIP Template Import 0.5%
  • CVE-2026-107762 High 7.5 Kirki <= 6.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via 'context' Parameter 0.4%
  • CVE-2026-93681 Medium 6.4 Tutor LMS <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name Parameter 0.2%
  • CVE-2026-88963 Medium 6.1 Tutor LMS <= 4.0.8 - Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting via 'redirect_url' Parameter 0.2%
  • CVE-2026-14572 Medium 6.4 Kirki <= 6.2.0 - Authenticated (Custom+) Stored Cross-Site Scripting via Page Builder Text Content 0.2%
  • CVE-2026-100193 Medium 4.7 Tutor LMS <= 4.1.0 - Reflected Cross-Site Scripting via 'tab' Parameter 0.2%
  • CVE-2026-42702 High 7.1 WordPress Tutor LMS plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-102291 Medium 5.4 Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'display_name' 0.3%
  • CVE-2026-42698 Medium 5.3 WordPress Tutor LMS plugin <= 4.1.1 - Race Condition vulnerability 0.2%
  • CVE-2026-102173 High 7.2 Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Unauthenticated Stored Cross-Site Scripting via Registration Metadata 0.4%
  • CVE-2026-103065 High 8.2 WordPress Kirki plugin <= 6.3.1 - Arbitrary Code Execution vulnerability 0.2%
  • CVE-2026-18335 Medium 5.4 Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Unauthenticated Blind Server-Side Request Forgery via 'kirki_data' Parameter 0.2%
  • CVE-2026-18439 Medium 4.3 Tutor LMS <= 4.0.7 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via 'payload' Parameter 0.4%
  • CVE-2026-89081 Medium 6.1 Tutor LMS <= 4.0.8 - Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters 0.4%
  • CVE-2026-88944 Medium 4.3 Tutor LMS <= 4.0.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id' Parameter 0.5%
  • CVE-2026-89333 Medium 6.5 Tutor LMS <= 4.0.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameter 0.5%
  • CVE-2026-92465 High 7.6 WordPress WP Mega Menu plugin <= 1.4.2 - SQL Injection vulnerability 0.4%
  • CVE-2026-78175 High 8.8 Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution 1.1%
  • CVE-2026-17037 High 7.2 Kirki <= 6.2.0 - Unauthenticated Stored Cross-Site Scripting via 'comment' Parameter 0.3%
  • CVE-2026-19945 Medium 6.4 WP Crowdfunding <= 2.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'first_name' Parameter 0.4%
  • CVE-2026-19944 Medium 4.9 WP Crowdfunding <= 2.2.1 - Authenticated (Shop Manager+) SQL Injection via 'wpneo_reward' Post Meta 0.4%
  • CVE-2026-16759 Medium 6.5 Tutor LMS <= 4.0.5 - Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters 0.7%