Vulnerabilidades en themeum
146 resultadosCVE-2024-37947MEDIUMWordPress Tutor LMS plugin <= 2.7.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-5438MEDIUMTutor LMS – eLearning and online course solution <= 2.7.1 - Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Quiz Attempt DeletionEPSS 0.3%CVE-2024-5576MEDIUMTutor LMS Elementor Addons <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Course Carousel WidgetEPSS 0.3%CVE-2026-1371MEDIUMTutor LMS <= 3.9.5 - Authenticated (Subscriber+) Information Disclosure in Coupon Details via 'tutor_coupon_details' AJAX ActionEPSS 0.3%CVE-2024-29913MEDIUMWordPress Tutor LMS Elementor Addons plugin <= 2.1.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-57694MEDIUMWordPress Tutor LMS plugin <= 3.9.13 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.3%CVE-2026-57680MEDIUMWordPress Kirki plugin <= 6.0.11 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.3%CVE-2024-4222HIGHTutor LMS Pro <= 2.7.0 - Missing AuthorizationEPSS 0.3%CVE-2025-47555LOWWordPress Tutor LMS plugin <= 3.9.4 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.3%CVE-2024-9601MEDIUMQubely – Advanced Gutenberg Blocks <= 1.8.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' and 'UniqueID'EPSS 0.3%CVE-2024-1804MEDIUMTutor LMS – Migration Tool <= 2.2.0 - Missing Authorization in tutor_import_from_xmlEPSS 0.3%CVE-2024-11910MEDIUMWP Crowdfunding <= 2.1.15 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2026-17037HIGHKirki <= 6.2.0 - Unauthenticated Stored Cross-Site Scripting via 'comment' ParameterEPSS 0.3%CVE-2024-10897MEDIUMTutor LMS Elementor Addons <= 2.1.5 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin InstallationEPSS 0.3%CVE-2025-32223MEDIUMWordPress Tutor LMS plugin <= 3.9.4 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.3%CVE-2026-75891HIGHKirki <= 6.2.5 - Authenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover via 'get-single-symbol' AJAX EndpointEPSS 0.3%CVE-2026-6965MEDIUMTutor LMS <= 3.9.9 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Post Deletion via 'course' GET ParameterEPSS 0.3%CVE-2026-102291MEDIUMKirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'display_name'EPSS 0.3%CVE-2026-118083HIGHWordPress WP Crowdfunding plugin <= 2.2.2 - Sensitive Data Exposure vulnerabilityEPSS 0.3%CVE-2026-0548MEDIUMTutor LMS – eLearning and online course solution <= 3.9.4 - Missing Authorization to Authenticated (Subscriber+) Limited Attachment DeletionEPSS 0.3%