Vulnerabilidades em Themeum
118 resultadosAnálise Vexday
Themeum apresenta 48 vulnerabilidades registradas, com 11 publicadas nos últimos 90 dias, indicando cadência moderada de descobertas. Nenhuma vulnerabilidade está sob ataque ativo no momento, embora 4 sejam críticas; a fraqueza predominante é injeção de conteúdo (CWE-79), típica de aplicações web. O risco atual é gerenciável, mas a presença de críticas e o padrão recente de descobertas justificam monitoramento contínuo.
CVE-2026-19945MEDIUMWP Crowdfunding <= 2.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'first_name' ParameterEPSS 0.2%CVE-2025-13934MEDIUMTutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Course Enrollment BypassEPSS 0.2%CVE-2025-13628MEDIUMTutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Coupon ModificationEPSS 0.2%CVE-2025-13935MEDIUMTutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Course CompletionEPSS 0.2%CVE-2026-24584MEDIUMWordPress Tutor LMS BunnyNet Integration plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2023-2919MEDIUMTutor LMS <= 2.7.4 - Cross-Site Request Forgery via 'addon_enable_disable'EPSS 0.2%CVE-2024-1503MEDIUMTutor LMS – eLearning and online course solution <= 2.6.1 - Cross-Site Request Forgery to Plugin Deactivation and Data EraseEPSS 0.2%CVE-2025-31892MEDIUMWordPress WP Crowdfunding plugin <= 2.1.15 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-65531MEDIUMWordPress Qubely plugin <= 1.8.14 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2025-26767MEDIUMWordPress Qubely plugin <= 1.8.12 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-6680MEDIUMTutor LMS <= 3.8.3 - Missing Authorization to Sensitive Information ExposureEPSS 0.2%CVE-2024-39645MEDIUMWordPress Tutor LMS plugin <= 2.7.2 - Cross Site Request Forgery (CSRF) vulnerabilityEPSS 0.2%CVE-2026-57627MEDIUMWordPress Kirki plugin <= 6.0.11 - Server Side Request Forgery (SSRF) vulnerabilityEPSS 0.2%CVE-2026-22329HIGHWordPress Skillate theme <= 1.2.10 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-40740MEDIUMWordPress Tutor LMS plugin <= 3.9.7 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-39638MEDIUMWordPress Qubely plugin <= 1.8.14 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-6639MEDIUMTutor LMS Pro – eLearning and online course solution <= 3.8.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to View/Edit Other AssignmentsEPSS 0.2%CVE-2026-16974MEDIUMKirki - Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_meta ShortcodeEPSS 0.2%