Vulnerabilidades en Themeum
126 resultadosAnálisis Vexday
Themeum apresenta 48 vulnerabilidades registradas, com 11 publicadas nos últimos 90 dias, indicando cadência moderada de descobertas. Nenhuma vulnerabilidade está sob ataque ativo no momento, embora 4 sejam críticas; a fraqueza predominante é injeção de conteúdo (CWE-79), típica de aplicações web. O risco atual é gerenciável, mas a presença de críticas e o padrão recente de descobertas justificam monitoramento contínuo.
CVE-2026-16974MEDIUMKirki - Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_meta ShortcodeEPSS 0.3%CVE-2026-19944MEDIUMWP Crowdfunding <= 2.2.1 - Authenticated (Shop Manager+) SQL Injection via 'wpneo_reward' Post MetaEPSS 0.3%CVE-2025-63042MEDIUMWordPress Tutor LMS Elementor Addons plugin <= 3.0.1 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-18335MEDIUMKirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Unauthenticated Blind Server-Side Request Forgery via 'kirki_data' ParameterEPSS 0.3%CVE-2026-57725HIGHWordPress Kirki plugin <= 6.0.11 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-66629HIGHWordPress Kirki plugin <= 6.2.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-18439MEDIUMTutor LMS <= 4.0.7 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via 'payload' ParameterEPSS 0.3%CVE-2026-24584MEDIUMWordPress Tutor LMS BunnyNet Integration plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-39638MEDIUMWordPress Qubely plugin <= 1.8.14 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-58663MEDIUMWordPress Qubely Plugin <= 1.8.14 - Broken Access Control VulnerabilityEPSS 0.2%CVE-2025-13679MEDIUMTutor LMS <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via tutor_order_detailsEPSS 0.2%CVE-2025-13934MEDIUMTutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Course Enrollment BypassEPSS 0.2%CVE-2025-13935MEDIUMTutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Course CompletionEPSS 0.2%CVE-2025-13628MEDIUMTutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Coupon ModificationEPSS 0.2%CVE-2023-2919MEDIUMTutor LMS <= 2.7.4 - Cross-Site Request Forgery via 'addon_enable_disable'EPSS 0.2%CVE-2025-31892MEDIUMWordPress WP Crowdfunding plugin <= 2.1.15 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-26767MEDIUMWordPress Qubely plugin <= 1.8.12 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-1503MEDIUMTutor LMS – eLearning and online course solution <= 2.6.1 - Cross-Site Request Forgery to Plugin Deactivation and Data EraseEPSS 0.2%CVE-2026-19945MEDIUMWP Crowdfunding <= 2.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'first_name' ParameterEPSS 0.2%CVE-2026-65531MEDIUMWordPress Qubely plugin <= 1.8.14 - Broken Access Control vulnerabilityEPSS 0.2%