PatchTheCVEthemeum vulnerabilities
Recent CVEs affecting themeum products. 23 tracked.
themeum has 23 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 23. Most recent: 2025-10-25. Highest priority: CVE-2024-10400 (score 56/100).
- CVE-2025-11564 MEDIUM 5.3 UPGRADE The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modifi
- CVE-2025-6680 MEDIUM 4.3 UPGRADE The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Sensitive Informati
- CVE-2025-5835 HIGH 8.8 UPGRADE The Droip plugin for WordPress is vulnerable to unauthorized modification and access of data due to a missing
- CVE-2025-5831 HIGH 8.8 UPGRADE The Droip plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in
- CVE-2025-26767 MEDIUM 6.5 UPGRADE Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum
- CVE-2025-1508 MEDIUM 5.3 UPGRADE The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized access of data due to a missing capabil
- CVE-2024-9601 MEDIUM 6.5 UPGRADE The Qubely – Advanced Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via t
- CVE-2024-5784 HIGH 7.1 UPGRADE The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized administrative actions execution due to
- CVE-2024-53816 MEDIUM 4.3 UPGRADE Missing Authorization vulnerability in Themeum Tutor LMS Elementor Addons tutor-lms-elementor-addons.This issu
- CVE-2024-43955 CRITICAL 10.0 UPGRADE Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themeum Droip
- CVE-2024-43954 MEDIUM 6.3 UPGRADE Incorrect Authorization vulnerability in Themeum Droip allows Accessing Functionality Not Properly Constrained
- CVE-2024-43937 MEDIUM 6.4 UPGRADE Missing Authorization vulnerability in Themeum WP Crowdfunding allows Exploiting Incorrectly Configured Access
- CVE-2024-43142 MEDIUM 4.3 UPGRADE Missing Authorization vulnerability in Themeum Tutor LMS allows Exploiting Incorrectly Configured Access Contr
- CVE-2024-39645 MEDIUM 5.4 UPGRADE Cross-Site Request Forgery (CSRF) vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a th
- CVE-2024-13228 MEDIUM 4.3 UPGRADE The Qubely – Advanced Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in
- CVE-2024-11911 MEDIUM 4.3 UPGRADE The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing ca
- CVE-2024-11910 MEDIUM 6.4 UPGRADE The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wp-crowdfunding/
- CVE-2024-10897 MEDIUM 4.3 UPGRADE The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to unauthorized plugin installation due to a
- CVE-2024-10400 HIGH 7.5 UPGRADE The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via the ‘rating_filter’ parameter in all ver
- CVE-2024-10393 MEDIUM 5.3 UPGRADE The Tutor LMS plugin for WordPress is vulnerable to bypass to user registration in versions up to, and includi
- CVE-2024-10117 MEDIUM 6.4 UPGRADE The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpcf_do
- CVE-2023-41870 MEDIUM 4.3 UPGRADE Missing Authorization vulnerability in Themeum WP Crowdfunding allows Exploiting Incorrectly Configured Access
- CVE-2023-2919 MEDIUM 4.3 UPGRADE The Tutor LMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and includin
FAQ
How do I fix themeum vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is themeum being exploited right now?
None of the tracked themeum CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which themeum CVE should I patch first?
CVE-2024-10400 currently ranks highest (56/100): The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via the ‘rating_filter’ parameter in all ver.