Vulnerabilities in Themeum
118 resultsVexday analysis
Themeum apresenta 48 vulnerabilidades registradas, com 11 publicadas nos últimos 90 dias, indicando cadência moderada de descobertas. Nenhuma vulnerabilidade está sob ataque ativo no momento, embora 4 sejam críticas; a fraqueza predominante é injeção de conteúdo (CWE-79), típica de aplicações web. O risco atual é gerenciável, mas a presença de críticas e o padrão recente de descobertas justificam monitoramento contínuo.
CVE-2024-43231MEDIUMWordPress Tutor LMS plugin <= 2.7.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-1371MEDIUMTutor LMS <= 3.9.5 - Authenticated (Subscriber+) Information Disclosure in Coupon Details via 'tutor_coupon_details' AJAX ActionEPSS 0.3%CVE-2025-32223MEDIUMWordPress Tutor LMS plugin <= 3.9.4 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.3%CVE-2024-43954MEDIUMWordPress Droip plugin <= 1.1.1 - Subscriber+ Settings Change/Data Exposure VulnerabilityEPSS 0.3%CVE-2026-22332CRITICALWordPress Tutor LMS Pro plugin <= 3.9.6 - SQL Injection vulnerabilityEPSS 0.3%CVE-2025-58993HIGHWordPress Tutor LMS Plugin <= 3.7.4 - SQL Injection VulnerabilityEPSS 0.3%CVE-2026-15444MEDIUMTutor LMS <= 4.0.1 - Authenticated (Administrator+) SQL Injection via 'coupon_code' ParameterEPSS 0.3%CVE-2023-50859MEDIUMWordPress WP Crowdfunding Plugin <= 2.1.6 is vulnerable to Cross Site Scripting (XSS)EPSS 0.3%CVE-2025-11564MEDIUMTutor LMS – eLearning and online course solution <= 3.8.3 - Missing Authorization to Unauthenticated Payment Status UpdateEPSS 0.3%CVE-2025-58249MEDIUMWordPress Qubely Plugin <= 1.8.14 - Sensitive Data Exposure VulnerabilityEPSS 0.3%CVE-2024-11911MEDIUMWP Crowdfunding <= 2.1.12 - Missing Authorization to Authenticated (Subscriber+) WooCommerce InstallationEPSS 0.3%CVE-2025-32230MEDIUMWordPress Tutor LMS plugin <= 3.4.0 - HTML Injection vulnerabilityEPSS 0.3%CVE-2026-19944MEDIUMWP Crowdfunding <= 2.2.1 - Authenticated (Shop Manager+) SQL Injection via 'wpneo_reward' Post MetaEPSS 0.3%CVE-2025-63042MEDIUMWordPress Tutor LMS Elementor Addons plugin <= 3.0.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-0548MEDIUMTutor LMS – eLearning and online course solution <= 3.9.4 - Missing Authorization to Authenticated (Subscriber+) Limited Attachment DeletionEPSS 0.3%CVE-2026-40743MEDIUMWordPress Tutor LMS plugin <= 3.9.7 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-57725HIGHWordPress Kirki plugin <= 6.0.11 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-66629HIGHWordPress Kirki plugin <= 6.2.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-58663MEDIUMWordPress Qubely Plugin <= 1.8.14 - Broken Access Control VulnerabilityEPSS 0.2%CVE-2025-13679MEDIUMTutor LMS <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via tutor_order_detailsEPSS 0.2%