Themeum vulnerabilities

CVEs per yearBy the year they were published

1. 20211
2. 20221
3. 20236
4. 202441
5. 202514
6. 202682

Newest CVEs

• CVE-2026-112348

  Kirki WordPress Plugin < 6.2.5 reCAPTCHA Bypass via Missing Token

  Themeum · Kirki

  Medium6.9
• CVE-2026-112347

  Kirki WordPress Plugin < 6.4.1 Broken Object-Level Access Control via Page API

  Themeum · Kirki

  High7.2
• CVE-2026-118083

  WordPress WP Crowdfunding plugin <= 2.2.2 - Sensitive Data Exposure vulnerability

  Themeum · WP Crowdfunding

  High7.5
• CVE-2026-42692

  WordPress WP Crowdfunding plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability

  Themeum · WP Crowdfunding

  High7.1
• CVE-2026-42694

  WordPress Kirki plugin <= 6.4.0 - Content Injection vulnerability

  Themeum · Kirki

  Medium4.3
• CVE-2026-75891

  Kirki <= 6.2.5 - Authenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover via 'get-single-symbol' AJAX Endpoint

  themeum · Kirki – Freeform Page Builder, Website Builder & Customizer

  High8.8
• CVE-2026-111407

  WordPress Tutor LMS plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerability

  Themeum · Tutor LMS

  Medium6.5
• CVE-2026-92715

  Tutor LMS <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover via 'ID' Parameter

  themeum · Tutor LMS – eLearning and online course solution

  Medium4.3
• CVE-2026-104734

  Kirki <= 6.3.2 - Authenticated (Administrator+) PHP Object Injection via Deserialization of Untrusted Input via ZIP Template Import

  themeum · Kirki – Freeform Page Builder, Website Builder & Customizer

  High7.2
• CVE-2026-107762

  Kirki <= 6.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via 'context' Parameter

  themeum · Kirki – Freeform Page Builder, Website Builder & Customizer

  High7.5