Vendor
Themeum vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 39 vulnerabilities in Themeum: 1 in the last 7 days and 16 in the last 90 days, 3 of them critical and 0 exploited in the wild. The most recent, CVE-2026-93779, was published on 7 November 2026. 7 vulnerabilities in the last four weeks, level on the four before (7). 2 technologies have a page of their own.
- Last 7 days
- 1
- Last 90 days
- 16
- Critical, all time
- 3
- Exploited in the wild
- 0
About Themeum
A software company that develops WordPress themes and plugins, including the Tutor LMS platform.
Themeum technologies
Latest Themeum vulnerabilities
- CVE-2026-93779: Tutor LMS insecure direct object reference in API routingmediumCVSS 6.5
- CVE-2026-112348: Kirki reCAPTCHA bypass in form submissionmediumCVSS 6.5
- CVE-2026-112347: Kirki page builder broken object-level access control in REST APIhighCVSS 7.6
- CVE-2026-42694: Themeum Kirki cross-site scripting vulnerability in HTML tag handlingmediumCVSS 4.3
- CVE-2026-111407: Themeum Tutor LMS stored cross-site scriptingmediumCVSS 6.5
- CVE-2026-92715: Tutor LMS insecure direct object reference in course updatemediumCVSS 4.3
- CVE-2026-93681: Tutor LMS stored cross-site scripting via display_namemediumCVSS 6.4EPSS 0.2%
- CVE-2026-42702: Themeum Tutor LMS reflected cross-site scripting vulnerabilityhighCVSS 7.1EPSS 0.2%
- CVE-2026-103065: Themeum Kirki arbitrary code execution in input validationhighCVSS 8.2EPSS 0.2%
- CVE-2026-18439: Tutor LMS insecure direct object reference in quiz buildermediumCVSS 4.3EPSS 0.3%
- CVE-2026-89081: Tutor LMS reflected cross-site scripting in search parametermediumCVSS 6.1EPSS 0.4%
- CVE-2026-88944: Tutor LMS authorization bypass in post deletionmediumCVSS 4.3EPSS 0.5%
- CVE-2026-92465: Themeum WP Mega Menu SQL injectionhighCVSS 7.6EPSS 0.4%
- CVE-2026-85569: Tutor LMS privilege escalation via REST API request misclassificationhighCVSS 7.2EPSS 0.5%
- CVE-2026-78175: Tutor LMS PHP Object Injection in withdraw method handlerhighCVSS 8.8EPSS 1.1%
- CVE-2026-19092: Tutor LMS plugin arbitrary function invocation in template renderingcriticalCVSS 9.8EPSS 2.0%
- CVE-2026-14310: Themeum Tutor LMS IDOR in Q&A threadsinfoCVSS 5.4
- CVE-2026-15444: Themeum Tutor LMS SQL injection in coupon_codemediumCVSS 4.9
- CVE-2026-65436: Themeum Kirki arbitrary file deletion in Editor componentmediumCVSS 6.8
- CVE-2026-65531: Themeum Qubely broken access controlmediumCVSS 4.8
- CVE-2026-1372: Themeum Tutor LMS Elementor Addons missing authorization in plugin activationmediumCVSS 4.3
- CVE-2026-15022: Themeum Tutor LMS SQL injection in Stored Quiz Answer ArraymediumCVSS 6.5
- CVE-2026-57727: Themeum Kirki missing authorization in access controlhighCVSS 7.5
- CVE-2026-57726: Themeum Kirki blind SQL injectioncriticalCVSS 9.3
- CVE-2026-57694: Themeum Tutor LMS IDOR authorization bypassmediumCVSS 6.5
Most severe Themeum vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-19092: Tutor LMS plugin arbitrary function invocation in template renderingcriticalCVSS 9.8EPSS 2.0%
- CVE-2026-57726: Themeum Kirki blind SQL injectioncriticalCVSS 9.3
- CVE-2026-22332: Themeum Tutor LMS Pro unauthenticated SQL injectioncriticalCVSS 9.3
- CVE-2026-78175: Tutor LMS PHP Object Injection in withdraw method handlerhighCVSS 8.8EPSS 1.1%
- CVE-2026-103065: Themeum Kirki arbitrary code execution in input validationhighCVSS 8.2EPSS 0.2%
- CVE-2026-22330: Themeum Right Way local file inclusionhighCVSS 8.1
- CVE-2026-92465: Themeum WP Mega Menu SQL injectionhighCVSS 7.6EPSS 0.4%
- CVE-2026-112347: Kirki page builder broken object-level access control in REST APIhighCVSS 7.6
- CVE-2026-57727: Themeum Kirki missing authorization in access controlhighCVSS 7.5
- CVE-2026-85569: Tutor LMS privilege escalation via REST API request misclassificationhighCVSS 7.2EPSS 0.5%
Vulnerabilities per week
7 vulnerabilities in the last four weeks, level on the four before (7). The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 1 | 1 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 1 | 0 | |
| 14 Sep 2026 | 4 | 0 | |
| 21 Sep 2026 | 1 | 0 | |
| 28 Sep 2026 | 1 | 0 | |
| 5 Oct 2026 | 1 | 0 | |
| 12 Oct 2026 | 2 | 0 | |
| 19 Oct 2026 | 1 | 0 | |
| 26 Oct 2026 | 3 | 0 | |
| 2 Nov 2026 | 1 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Themeum vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/themeum)<a href="https://junglewise.ai/threats/vendors/themeum"><img src="https://junglewise.ai/threats/vendors/themeum/badge.svg" alt="Themeum vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/themeum.json, and this page as text at https://junglewise.ai/threats/vendors/themeum.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Themeum vulnerabilities", https://junglewise.ai/threats/vendors/themeum, 10 November 2026.