en
Themeum is a WordPress tools developer (an Ollyo company) delivering plugins and add-ons that extend site functionality. Core offerings include LMS, page builders, crowdfunding, and UI customization for a global WordPress user base.
As of 11/08/2026, themeum recorded 35 security vulnerabilities in the last 90 days across 6 products, including 13 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, Kirki – Freeform Page Builder, Website Builder & Customizer had the most security vulnerabilities in the themeum ecosystem, with 11 vulnerabilities—approximately 31.43% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-12122Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via kirki_post_apis_nopriv AJAX ActionCVE-2026-13443Tutor LMS <= 3.9.13 - Authenticated (Author+) Stored Cross-Site Scripting via Lesson Attachment TitleCVE-2026-57627WordPress Kirki plugin <= 6.0.11 - Server Side Request Forgery (SSRF) vulnerabilityCVE-2026-10736Tutor LMS <= 3.9.11 - Authenticated (Administrator+) SQL Injection via 'data' ParameterCVE-2026-22332WordPress Tutor LMS Pro plugin <= 3.9.6 - SQL Injection vulnerability| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-12122Kirki <= 6.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via kirki_post_apis_nopriv AJAX Action | Exploitation statusNot exploited | FixYes |
| Affected productKirki – Freeform Page Builder, Website Builder & Customizer |
| Published07/02/2026 |
| SeverityMedium |
CVE-2026-13443Tutor LMS <= 3.9.13 - Authenticated (Author+) Stored Cross-Site Scripting via Lesson Attachment Title | Exploitation statusNot exploited | FixYes | Affected productTutor LMS – eLearning and online course solution | Published07/01/2026 | SeverityMedium |
|---|
CVE-2026-57627WordPress Kirki plugin <= 6.0.11 - Server Side Request Forgery (SSRF) vulnerability | Exploitation statusNot exploited | FixYes | Affected productKirki | Published06/26/2026 | SeverityMedium |
|---|
CVE-2026-10736Tutor LMS <= 3.9.11 - Authenticated (Administrator+) SQL Injection via 'data' Parameter | Exploitation statusNot exploited | FixYes | Affected productTutor LMS – eLearning and online course solution | Published06/18/2026 | SeverityMedium |
|---|
CVE-2026-22332WordPress Tutor LMS Pro plugin <= 3.9.6 - SQL Injection vulnerability | Exploitation statusNot exploited | FixYes | Affected productTutor LMS Pro | Published06/17/2026 | SeverityCritical |
|---|
CVE-2026-22330WordPress Right Way theme <= 4.0 - Local File Inclusion vulnerability | Exploitation statusNot exploited | FixYes | Affected productRight Way | Published06/17/2026 | SeverityHigh |
|---|
CVE-2026-22329WordPress Skillate theme <= 1.2.10 - Reflected Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productSkillate | Published06/17/2026 | SeverityHigh |
|---|
CVE-2026-40743WordPress Tutor LMS plugin <= 3.9.7 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productTutor LMS | Published06/15/2026 | SeverityMedium |
|---|
CVE-2026-8206Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password' | Exploitation statusNot exploited | FixYes | Affected productKirki – Freeform Page Builder, Website Builder & Customizer | Published06/02/2026 | SeverityCritical |
|---|
CVE-2026-8096Kirki <= 6.0.6 - Missing Authorization to Authenticated (Subscriber+) Sensitive Form Submission Data Exposure via 'kirki_wp_admin_get_apis' Action | Exploitation statusNot exploited | FixYes | Affected productKirki – Freeform Page Builder, Website Builder & Customizer | Published05/19/2026 | SeverityMedium |
|---|
CVE-2026-8073Kirki <= 6.0.6 - Unauthenticated Limited Arbitrary File Read and Deletion via downloadZIP | Exploitation statusNot exploited | FixYes | Affected productKirki – Freeform Page Builder, Website Builder & Customizer | Published05/19/2026 | SeverityHigh |
|---|
CVE-2026-6965Tutor LMS <= 3.9.9 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Post Deletion via 'course' GET Parameter | Exploitation statusNot exploited | FixYes | Affected productTutor LMS – eLearning and online course solution | Published05/13/2026 | SeverityMedium |
|---|
CVE-2026-6080Tutor LMS <= 3.9.8 - Authenticated (Admin+) SQL Injection via 'date' Parameter | Exploitation statusNot exploited | FixYes | Affected productTutor LMS – eLearning and online course solution | Published04/17/2026 | SeverityMedium |
|---|
CVE-2026-5502Tutor LMS <= 3.9.8 - Authenticated (Subscriber+) Arbitrary Course Content Manipulation via tutor_update_course_content_order | Exploitation statusNot exploited | FixYes | Affected productTutor LMS – eLearning and online course solution | Published04/17/2026 | SeverityMedium |
|---|
CVE-2026-40740WordPress Tutor LMS plugin <= 3.9.7 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productTutor LMS | Published04/15/2026 | SeverityMedium |
|---|
CVE-2026-3371Tutor LMS <= 3.9.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Course Content Modification | Exploitation statusNot exploited | FixYes | Affected productTutor LMS – eLearning and online course solution | Published04/11/2026 | SeverityMedium |
|---|
CVE-2026-3358Tutor LMS <= 3.9.7 - Missing Authorization to Authenticated (Subscriber+) Unauthorized Private Course Enrollment | Exploitation statusNot exploited | FixYes | Affected productTutor LMS – eLearning and online course solution | Published04/11/2026 | SeverityMedium |
|---|
CVE-2026-3360Tutor LMS <= 3.9.7 - Missing Authorization to Unauthenticated Arbitrary Billing Profile Overwrite via 'order_id' Parameter | Exploitation statusNot exploited | FixYes | Affected productTutor LMS – eLearning and online course solution | Published04/10/2026 | SeverityHigh |
|---|
CVE-2026-39638WordPress Qubely plugin <= 1.8.14 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productQubely | Published04/08/2026 | SeverityMedium |
|---|
CVE-2026-25406WordPress Tutor LMS Pro plugin <= 3.9.4 - Broken Authentication vulnerability | Exploitation statusNot exploited | FixYes | Affected productTutor LMS Pro | Published03/25/2026 | SeverityHigh |
|---|
CVE-2025-32223WordPress Tutor LMS plugin <= 3.9.4 - Insecure Direct Object References (IDOR) vulnerability | Exploitation statusNot exploited | FixYes | Affected productTutor LMS | Published03/19/2026 | SeverityMedium |
|---|
CVE-2026-0953Tutor LMS Pro <= 3.9.5 - Authentication Bypass via Social Login | Exploitation statusNot exploited | FixYes | Affected productTutor LMS Pro | Published03/10/2026 | SeverityCritical |
|---|
CVE-2026-23799WordPress Tutor LMS plugin <= 3.9.5 - Broken Access Control vulnerability | Exploitation statusNot exploited | FixYes | Affected productTutor LMS | Published03/05/2026 | SeverityMedium |
|---|
CVE-2025-13673Tutor LMS <= 3.9.6 - Unauthenticated SQL Injection via coupon_code | Exploitation statusNot exploited | FixYes | Affected productTutor LMS – eLearning and online course solution | Published02/28/2026 | SeverityHigh |
|---|
CVE-2026-1375Tutor LMS <= 3.9.5 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Course Modification and Deletion | Exploitation statusNot exploited | FixYes | Affected productTutor LMS – eLearning and online course solution | Published02/03/2026 | SeverityHigh |
|---|
CVE-2026-1371Tutor LMS <= 3.9.5 - Authenticated (Subscriber+) Information Disclosure in Coupon Details via 'tutor_coupon_details' AJAX Action | Exploitation statusNot exploited | FixYes | Affected productTutor LMS – eLearning and online course solution | Published02/03/2026 | SeverityMedium |
|---|
CVE-2026-24584WordPress Tutor LMS BunnyNet Integration plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productTutor LMS BunnyNet Integration | Published01/23/2026 | SeverityMedium |
|---|
CVE-2025-47555WordPress Tutor LMS plugin <= 3.9.4 - Insecure Direct Object References (IDOR) vulnerability | Exploitation statusNot exploited | FixYes | Affected productTutor LMS | Published01/22/2026 | SeverityLow |
|---|
CVE-2026-0548Tutor LMS – eLearning and online course solution <= 3.9.4 - Missing Authorization to Authenticated (Subscriber+) Limited Attachment Deletion | Exploitation statusNot exploited | FixYes | Affected productTutor LMS – eLearning and online course solution | Published01/20/2026 | SeverityMedium |
|---|
CVE-2025-13935Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Course Completion | Exploitation statusNot exploited | FixYes | Affected productTutor LMS – eLearning and online course solution | Published01/09/2026 | SeverityMedium |
|---|
CVE-2025-13934Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Course Enrollment Bypass | Exploitation statusNot exploited | FixYes | Affected productTutor LMS – eLearning and online course solution | Published01/09/2026 | SeverityMedium |
|---|
CVE-2025-13628Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Coupon Modification | Exploitation statusNot exploited | FixYes | Affected productTutor LMS – eLearning and online course solution | Published01/09/2026 | SeverityMedium |
|---|
CVE-2025-13679Tutor LMS <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via tutor_order_details | Exploitation statusNot exploited | FixYes | Affected productTutor LMS – eLearning and online course solution | Published01/08/2026 | SeverityMedium |
|---|
CVE-2025-63042WordPress Tutor LMS Elementor Addons plugin <= 3.0.1 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productTutor LMS Elementor Addons | Published12/09/2025 | SeverityMedium |
|---|
CVE-2025-6680Tutor LMS <= 3.8.3 - Missing Authorization to Sensitive Information Exposure | Exploitation statusNot exploited | FixYes | Affected productTutor LMS – eLearning and online course solution | Published10/25/2025 | SeverityMedium |
|---|
CVE-2025-6639Tutor LMS Pro – eLearning and online course solution <= 3.8.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to View/Edit Other Assignments | Exploitation statusNot exploited | FixYes | Affected productTutor LMS Pro | Published10/25/2025 | SeverityMedium |
|---|
CVE-2025-11564Tutor LMS – eLearning and online course solution <= 3.8.3 - Missing Authorization to Unauthenticated Payment Status Update | Exploitation statusNot exploited | FixYes | Affected productTutor LMS – eLearning and online course solution | Published10/25/2025 | SeverityMedium |
|---|
CVE-2025-58663WordPress Qubely Plugin <= 1.8.14 - Broken Access Control Vulnerability | Exploitation statusNot exploited | FixYes | Affected productQubely | Published09/22/2025 | SeverityMedium |
|---|
CVE-2025-58249WordPress Qubely Plugin <= 1.8.14 - Sensitive Data Exposure Vulnerability | Exploitation statusNot exploited | FixYes | Affected productQubely | Published09/22/2025 | SeverityMedium |
|---|
CVE-2025-58993WordPress Tutor LMS Plugin <= 3.7.4 - SQL Injection Vulnerability | Exploitation statusNot exploited | FixYes | Affected productTutor LMS | Published09/09/2025 | SeverityHigh |
|---|
CVE-2025-6184Tutor LMS Pro – eLearning and online course solution <= 3.7.0 - Authenticated (Tutor Instructor+) SQL Injection | Exploitation statusNot exploited | FixYes | Affected productTutor LMS Pro | Published08/13/2025 | SeverityHigh |
|---|
CVE-2025-32230WordPress Tutor LMS plugin <= 3.4.0 - HTML Injection vulnerability | Exploitation statusNot exploited | FixYes | Affected productTutor LMS | Published04/10/2025 | SeverityMedium |
|---|
CVE-2025-31892WordPress WP Crowdfunding plugin <= 2.1.15 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productWP Crowdfunding | Published04/01/2025 | SeverityMedium |
|---|
CVE-2025-1508WP Crowdfunding <= 2.1.14 - Missing Authorization to Authenticated (Subscriber+) Post Content Download | Exploitation statusNot exploited | FixYes | Affected productWP Crowdfunding | Published03/12/2025 | SeverityMedium |
|---|
CVE-2024-13228Qubely – Advanced Gutenberg Blocks <= 1.8.13 - Authenticated (Contributor+) Sensitive Information Exposure via qubely_get_content | Exploitation statusNot exploited | FixYes | Affected productQubely – Advanced Gutenberg Blocks | Published03/11/2025 | SeverityMedium |
|---|
CVE-2025-26767WordPress Qubely plugin <= 1.8.12 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Affected productQubely | Published02/16/2025 | SeverityMedium |
|---|
CVE-2024-9601Qubely – Advanced Gutenberg Blocks <= 1.8.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' and 'UniqueID' | Exploitation statusNot exploited | FixYes | Affected productQubely – Advanced Gutenberg Blocks | Published02/14/2025 | SeverityMedium |
|---|
CVE-2024-54282WordPress WP Mega Menu plugin <= 1.4.2 - PHP Object Injection vulnerability | Exploitation statusNot exploited | FixYes | Affected productWP Mega Menu | Published12/13/2024 | SeverityHigh |
|---|
CVE-2024-11911WP Crowdfunding <= 2.1.12 - Missing Authorization to Authenticated (Subscriber+) WooCommerce Installation | Exploitation statusNot exploited | FixYes | Affected productWP Crowdfunding | Published12/13/2024 | SeverityMedium |
|---|
CVE-2024-11910WP Crowdfunding <= 2.1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting | Exploitation statusNot exploited | FixYes | Affected productWP Crowdfunding | Published12/13/2024 | SeverityMedium |
|---|
146 Results | Page 2 of 3