Skip to content
OpenAdvisories

Vendor

Themeum

146 known vulnerabilities.

Products

Tutor LMS – eLearning and online course solution 48 Tutor LMS 22 Kirki – Freeform Page Builder, Website Builder & Customizer 19 WP Crowdfunding 13 Kirki 12 Tutor LMS Pro 9 Tutor LMS Elementor Addons 6 Qubely 5 Droip 2 Tutor LMS – Migration Tool 2 Qubely – Advanced Gutenberg Blocks 2 WP Mega Menu 2 Skillate 1 WP Page Builder (WordPress plugin) 1 Right Way 1 Tutor LMS BunnyNet Integration 1
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 7.5
    CVE-2025-13673 Public exploit

    Tutor LMS <= 3.9.6 - Unauthenticated SQL Injection via coupon_code

    The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to SQL Injection via the 'coupon_code' parameter in all versions up to, and including, 3.9.6 due to insufficient escaping on the user supplied parameter and lack of suffic…

    Themeum Tutor LMS – eLearning and online course solution Web / CMS
  • High 8.1
    CVE-2026-1375 Public exploit

    Tutor LMS <= 3.9.5 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Course Modification and Deletion

    The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object References (IDOR) in all versions up to, and including, 3.9.5. This is due to missing object-level authorization checks in the `course_list_bulk_…

    Themeum Tutor LMS – eLearning and online course solution Web / CMS
  • High 7.5
    CVE-2024-10400 Public exploit EPSS 83%

    Tutor LMS <= 2.7.6 - Unauthenticated SQL Injection via rating_filter

    The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via the ‘rating_filter’ parameter in all versions up to, and including, 2.7.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL …

    Themeum Tutor LMS – eLearning and online course solution Web / CMS
  • High 8.8
    CVE-2024-4351 Public exploit

    Tutor LMS Pro <= 2.7.0 - Missing Authorization to Privilege Escalation

    The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on the 'authenticate' function in all versions up to, and including, 2.7.0. This makes it possible for au…

    Themeum Tutor LMS Pro Web / CMS