Vulnerabilidades en themeum

125 resultados
Análisis Vexday

Com 52 CVEs catalogadas e nenhuma confirmada em exploração ativa no catálogo KEV da CISA, o vendor Themeum apresenta taxa de exploração abaixo da média geral do catálogo. No entanto, o cenário exige atenção: a CVE mais perigosa identificada, CVE-2024-10400, registra EPSS de 0,8259 — indicando alta probabilidade estimada de exploração —, e o tipo de falha predominante é CWE-862 (ausência de verificação de autorização), uma classe de vulnerabilidade que facilita acesso não autorizado a funcionalidades protegidas. O surgimento de 10 novas CVEs nos últimos 90 dias, combinado com a existência de prova de conceito pública para ao menos uma delas, sugere uma superfície de ataque em expansão que merece monitoramento contínuo e priorização de correções, especialmente em ambientes que dependem de plugins ou temas deste vendor.

CVE-2026-40743MEDIUMWordPress Tutor LMS plugin <= 3.9.7 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-57725HIGHWordPress Kirki plugin <= 6.0.11 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-18439MEDIUMTutor LMS <= 4.0.7 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via 'payload' ParameterEPSS 0.3%CVE-2026-24584MEDIUMWordPress Tutor LMS BunnyNet Integration plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-66629HIGHWordPress Kirki plugin <= 6.2.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-58663MEDIUMWordPress Qubely Plugin <= 1.8.14 - Broken Access Control VulnerabilityEPSS 0.2%CVE-2025-13679MEDIUMTutor LMS <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via tutor_order_detailsEPSS 0.2%CVE-2026-19945MEDIUMWP Crowdfunding <= 2.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'first_name' ParameterEPSS 0.2%CVE-2025-13935MEDIUMTutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Course CompletionEPSS 0.2%CVE-2025-13628MEDIUMTutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Coupon ModificationEPSS 0.2%CVE-2025-13934MEDIUMTutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Course Enrollment BypassEPSS 0.2%CVE-2023-2919MEDIUMTutor LMS <= 2.7.4 - Cross-Site Request Forgery via 'addon_enable_disable'EPSS 0.2%CVE-2025-31892MEDIUMWordPress WP Crowdfunding plugin <= 2.1.15 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-1503MEDIUMTutor LMS – eLearning and online course solution <= 2.6.1 - Cross-Site Request Forgery to Plugin Deactivation and Data EraseEPSS 0.2%CVE-2025-26767MEDIUMWordPress Qubely plugin <= 1.8.12 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2026-65531MEDIUMWordPress Qubely plugin <= 1.8.14 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-89081MEDIUMTutor LMS <= 4.0.8 - Reflected Cross-Site Scripting via 'back_url' and 'search' ParametersEPSS 0.2%CVE-2025-6680MEDIUMTutor LMS <= 3.8.3 - Missing Authorization to Sensitive Information ExposureEPSS 0.2%CVE-2024-39645MEDIUMWordPress Tutor LMS plugin <= 2.7.2 - Cross Site Request Forgery (CSRF) vulnerabilityEPSS 0.2%CVE-2026-57627MEDIUMWordPress Kirki plugin <= 6.0.11 - Server Side Request Forgery (SSRF) vulnerabilityEPSS 0.2%