Vulnerabilidades em Themeum
124 resultadosAnálise Vexday
Themeum apresenta 48 vulnerabilidades registradas, com 11 publicadas nos últimos 90 dias, indicando cadência moderada de descobertas. Nenhuma vulnerabilidade está sob ataque ativo no momento, embora 4 sejam críticas; a fraqueza predominante é injeção de conteúdo (CWE-79), típica de aplicações web. O risco atual é gerenciável, mas a presença de críticas e o padrão recente de descobertas justificam monitoramento contínuo.
CVE-2026-40743MEDIUMWordPress Tutor LMS plugin <= 3.9.7 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-57725HIGHWordPress Kirki plugin <= 6.0.11 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-66629HIGHWordPress Kirki plugin <= 6.2.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-58663MEDIUMWordPress Qubely Plugin <= 1.8.14 - Broken Access Control VulnerabilityEPSS 0.2%CVE-2025-13679MEDIUMTutor LMS <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via tutor_order_detailsEPSS 0.2%CVE-2026-19945MEDIUMWP Crowdfunding <= 2.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'first_name' ParameterEPSS 0.2%CVE-2026-24584MEDIUMWordPress Tutor LMS BunnyNet Integration plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-13628MEDIUMTutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Coupon ModificationEPSS 0.2%CVE-2025-13935MEDIUMTutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Course CompletionEPSS 0.2%CVE-2025-13934MEDIUMTutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Course Enrollment BypassEPSS 0.2%CVE-2023-2919MEDIUMTutor LMS <= 2.7.4 - Cross-Site Request Forgery via 'addon_enable_disable'EPSS 0.2%CVE-2025-31892MEDIUMWordPress WP Crowdfunding plugin <= 2.1.15 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-26767MEDIUMWordPress Qubely plugin <= 1.8.12 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2024-1503MEDIUMTutor LMS – eLearning and online course solution <= 2.6.1 - Cross-Site Request Forgery to Plugin Deactivation and Data EraseEPSS 0.2%CVE-2026-65531MEDIUMWordPress Qubely plugin <= 1.8.14 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-89081MEDIUMTutor LMS <= 4.0.8 - Reflected Cross-Site Scripting via 'back_url' and 'search' ParametersEPSS 0.2%CVE-2025-6680MEDIUMTutor LMS <= 3.8.3 - Missing Authorization to Sensitive Information ExposureEPSS 0.2%CVE-2024-39645MEDIUMWordPress Tutor LMS plugin <= 2.7.2 - Cross Site Request Forgery (CSRF) vulnerabilityEPSS 0.2%CVE-2026-57627MEDIUMWordPress Kirki plugin <= 6.0.11 - Server Side Request Forgery (SSRF) vulnerabilityEPSS 0.2%CVE-2026-22329HIGHWordPress Skillate theme <= 1.2.10 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%