Vulnerabilities in Themeum
118 resultsVexday analysis
Themeum apresenta 48 vulnerabilidades registradas, com 11 publicadas nos últimos 90 dias, indicando cadência moderada de descobertas. Nenhuma vulnerabilidade está sob ataque ativo no momento, embora 4 sejam críticas; a fraqueza predominante é injeção de conteúdo (CWE-79), típica de aplicações web. O risco atual é gerenciável, mas a presença de críticas e o padrão recente de descobertas justificam monitoramento contínuo.
CVE-2024-10400HIGHTutor LMS <= 2.7.6 - Unauthenticated SQL Injection via rating_filterEPSS 83.1%CVE-2024-1751HIGHTutor LMS – eLearning and online course solution <= 2.6.1 - Authenticated (Subscriber+) SQL InjectionEPSS 3.1%CVE-2026-8206CRITICALKirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'EPSS 1.3%CVE-2024-4352HIGHTutor LMS Pro <= 2.7.0 - Missing Authorization to SQL InjectionEPSS 1.2%CVE-2026-15457MEDIUMKirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary Directory Deletion via 'family' ParameterEPSS 1.1%CVE-2024-4351HIGHTutor LMS Pro <= 2.7.0 - Missing Authorization to Privilege EscalationEPSS 1.0%CVE-2024-54282HIGHWordPress WP Mega Menu plugin <= 1.4.2 - PHP Object Injection vulnerabilityEPSS 0.8%CVE-2023-41870MEDIUMWordPress WP Crowdfunding plugin <= 2.1.5 - Broken Access Control vulnerabilityEPSS 0.8%CVE-2026-17604MEDIUMKirki <= 6.1.1 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' ParameterEPSS 0.8%CVE-2021-24242—Tutor LMS < 1.8.8 - Authenticated Local File InclusionEPSS 0.8%CVE-2023-25700HIGHWordPress Tutor LMS Plugin <= 2.1.10 is vulnerable to SQL InjectionEPSS 0.8%CVE-2026-15601MEDIUMKirki <= 6.0.13 - Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip)EPSS 0.7%CVE-2023-25800HIGHWordPress Tutor LMS Plugin <= 2.2.0 is vulnerable to SQL InjectionEPSS 0.7%CVE-2023-25990HIGHWordPress Tutor LMS Plugin <= 2.1.10 is vulnerable to SQL InjectionEPSS 0.7%CVE-2026-0953CRITICALTutor LMS Pro <= 3.9.5 - Authentication Bypass via Social LoginEPSS 0.7%CVE-2024-37266MEDIUMWordPress Tutor LMS plugin <= 2.7.1 - Path Traversal vulnerabilityEPSS 0.6%CVE-2026-3360HIGHTutor LMS <= 3.9.7 - Missing Authorization to Unauthenticated Arbitrary Billing Profile Overwrite via 'order_id' ParameterEPSS 0.6%CVE-2024-43955CRITICALWordPress Droip plugin <= 1.1.1 - Unauthenticated Arbitrary File Download/Deletion vulnerabilityEPSS 0.6%CVE-2026-12472MEDIUMKirki <= 6.0.11 - Missing Authorization to Unauthenticated Arbitrary Email Content Injection (Mail Relay / Phishing) via 'emailBody' and 'emailSubject' ParametersEPSS 0.6%CVE-2024-10393MEDIUMTutor LMS <= 2.7.6 - User Registration Setting Bypass to Unauthorized User RegistrationEPSS 0.6%