Skip to content
OpenAdvisories

Vendor

Themeum

146 known vulnerabilities.

Products

Tutor LMS – eLearning and online course solution 48 Tutor LMS 22 Kirki – Freeform Page Builder, Website Builder & Customizer 19 WP Crowdfunding 13 Kirki 12 Tutor LMS Pro 9 Tutor LMS Elementor Addons 6 Qubely 5 Droip 2 Tutor LMS – Migration Tool 2 Qubely – Advanced Gutenberg Blocks 2 WP Mega Menu 2 Skillate 1 WP Page Builder (WordPress plugin) 1 Right Way 1 Tutor LMS BunnyNet Integration 1
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-8206 Public exploit

    Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'

    The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions 6.0.0 to 6.0.6. This is due to the plugin accepting an arbitrary email address when a username is u…

    Themeum Kirki – Freeform Page Builder, Website Builder & Customizer Web / CMS
  • High 7.5
    CVE-2025-13673 Public exploit

    Tutor LMS <= 3.9.6 - Unauthenticated SQL Injection via coupon_code

    The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to SQL Injection via the 'coupon_code' parameter in all versions up to, and including, 3.9.6 due to insufficient escaping on the user supplied parameter and lack of suffic…

    Themeum Tutor LMS – eLearning and online course solution Web / CMS
  • High 8.1
    CVE-2026-1375 Public exploit

    Tutor LMS <= 3.9.5 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Course Modification and Deletion

    The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object References (IDOR) in all versions up to, and including, 3.9.5. This is due to missing object-level authorization checks in the `course_list_bulk_…

    Themeum Tutor LMS – eLearning and online course solution Web / CMS
  • High 7.5
    CVE-2024-10400 Public exploit EPSS 83%

    Tutor LMS <= 2.7.6 - Unauthenticated SQL Injection via rating_filter

    The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via the ‘rating_filter’ parameter in all versions up to, and including, 2.7.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL …

    Themeum Tutor LMS – eLearning and online course solution Web / CMS
  • High 8.8
    CVE-2024-4351 Public exploit

    Tutor LMS Pro <= 2.7.0 - Missing Authorization to Privilege Escalation

    The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on the 'authenticate' function in all versions up to, and including, 2.7.0. This makes it possible for au…

    Themeum Tutor LMS Pro Web / CMS
  • Medium 6.5
    CVE-2024-3553 Public exploit

    Tutor LMS <= 2.6.2 - Missing Authorization to Unauthenticated Limited Options Update

    The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the hide_notices function in all versions up to, and including, 2.6.2. This makes it possible for…

    Themeum Tutor LMS – eLearning and online course solution Web / CMS