Skip to content
OpenAdvisories

Vendor

Themeum

146 known vulnerabilities.

Products

Tutor LMS – eLearning and online course solution 48 Tutor LMS 22 Kirki – Freeform Page Builder, Website Builder & Customizer 19 WP Crowdfunding 13 Kirki 12 Tutor LMS Pro 9 Tutor LMS Elementor Addons 6 Qubely 5 Droip 2 Tutor LMS – Migration Tool 2 Qubely – Advanced Gutenberg Blocks 2 WP Mega Menu 2 Skillate 1 WP Page Builder (WordPress plugin) 1 Right Way 1 Tutor LMS BunnyNet Integration 1
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Critical 9.3
    CVE-2026-57726

    WordPress Kirki plugin <= 6.0.12 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Kirki kirki allows Blind SQL Injection.This issue affects Kirki: from n/a through <= 6.0.12.

    Themeum Kirki
  • Critical 9.8
    CVE-2026-57724

    WordPress Kirki plugin <= 6.0.12 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in Themeum Kirki kirki allows Object Injection.This issue affects Kirki: from n/a through <= 6.0.12.

    Themeum Kirki
  • Critical 9.3
    CVE-2026-22332

    WordPress Tutor LMS Pro plugin <= 3.9.6 - SQL Injection vulnerability

    Unauthenticated SQL Injection in Tutor LMS Pro <= 3.9.6 versions.

    Themeum Tutor LMS Pro
  • Critical 9.8
    CVE-2026-8206 Public exploit

    Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'

    The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions 6.0.0 to 6.0.6. This is due to the plugin accepting an arbitrary email address when a username is u…

    Themeum Kirki – Freeform Page Builder, Website Builder & Customizer Web / CMS
  • Critical 9.8
    CVE-2026-0953

    Tutor LMS Pro <= 3.9.5 - Authentication Bypass via Social Login

    The Tutor LMS Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 3.9.5 via the Social Login addon. This is due to the plugin failing to verify that the email provided in the authentication request matches the…

    Themeum Tutor LMS Pro Web / CMS
  • Critical 10.0
    CVE-2024-43955

    WordPress Droip plugin <= 1.1.1 - Unauthenticated Arbitrary File Download/Deletion vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themeum Droip allows File Manipulation.This issue affects Droip: from n/a through 1.1.1.

    Themeum Droip
  • Critical 9.8
    CVE-2024-4223

    Tutor LMS <= 2.7.0 - Missing Authorization

    The Tutor LMS plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on multiple functions in all versions up to, and including, 2.7.0. This makes it possible for unauthenticated…

    Themeum Tutor LMS – eLearning and online course solution Web / CMS