How many CVEs does themeum have?

themeum has 150 published CVE records since 2020, including 77 in the last two years.

How many themeum CVEs are in CISA KEV?

None of themeum's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which themeum products have the most CVEs?

The themeum products with the most published CVEs are Tutor LMS, Tutor LMS – eLearning and online course solution, WP Crowdfunding, Kirki – Freeform Page Builder, Website Builder & Customizer, Qubely.

What are the most common weakness types in themeum CVEs?

themeum's CVEs most often map to these CWE weakness types: CWE-862 (Missing Authorization), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')), CWE-639 (Authorization Bypass Through User-Controlled Key).

Are there public exploits for themeum vulnerabilities?

Yes — 25 of themeum's CVEs have a known public exploit.

How many critical themeum vulnerabilities are there?

themeum has 8 critical and 39 high-severity CVEs.

What is the average severity of themeum CVEs?

The average CVSS base score across themeum's scored CVEs is 6.4.

RadicalNotion.AI

Log in Start free

150 CVEs

themeum Vulnerabilities

Name: themeum vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for themeum.

150

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

25

Public exploits

PoC or exploit code

6.4

Avg CVSS

2020–2026

Overview

themeum has 150 published CVE records since 2020, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 25 have a known public exploit. The average CVSS base score across scored CVEs is 6.4.

This page aggregates every publicly disclosed vulnerability (CVE) affecting themeum products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.

Security scorecard

A quick read on themeum's vulnerability posture, as a share of its 150 published CVEs.

Average CVSS: 6.4
Critical / high: 31%
Actively exploited (KEV): 0%
Public exploit available: 17%
Patch available: 61%

Severity and exploitation

How the CVSS severity of themeum's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical8

High39

Medium101

Low2

In CISA’s Known Exploited Vulnerabilities catalog

0

None of themeum's CVEs are currently listed in CISA's KEV catalog.

Public exploits

25

25 of themeum's CVEs have a known public exploit available.

Most affected products

The themeum products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in themeum CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish themeum CVE records.

Disclosure activity by year

How many themeum CVEs were published each year.

2020

1

2021

12

2022

5

2023

11

2024

44

2025

16

2026

61

Latest themeum CVEs

The most recently disclosed vulnerabilities affecting themeum.

Tutor LMS <= 4.0.8 - Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters
CWE-79
Medium · CVSS 6.1
EPSS 0.2%2026-09-19
Tutor LMS <= 4.0.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id' Parameter
CWE-862
Medium · CVSS 4.3
EPSS 0.3%2026-09-19
Tutor LMS <= 4.0.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameter
CWE-639
Medium · CVSS 6.5
EPSS 0.3%2026-09-19
WordPress WP Mega Menu plugin <= 1.4.2 - SQL Injection vulnerability
CWE-89
High · CVSS 7.6
EPSS 0.3%2026-09-16
Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution
CWE-502
High · CVSS 8.8
EPSS 0.6%2026-09-12
Kirki <= 6.2.0 - Unauthenticated Stored Cross-Site Scripting via 'comment' Parameter
CWE-79
High · CVSS 7.2
EPSS 0.3%2026-09-11
WP Crowdfunding <= 2.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'first_name' Parameter
CWE-79
Medium · CVSS 6.4
EPSS 0.2%2026-09-09
WP Crowdfunding <= 2.2.1 - Authenticated (Shop Manager+) SQL Injection via 'wpneo_reward' Post Meta
CWE-89
Medium · CVSS 4.9
EPSS 0.3%2026-09-09
Tutor LMS <= 4.0.5 - Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters
CWE-74
Medium · CVSS 6.5
EPSS 0.4%2026-08-28
WordPress Kirki plugin <= 6.2.3 - Cross Site Scripting (XSS) vulnerability
CWE-79
High · CVSS 7.1
EPSS 0.2%2026-08-18
Kirki <= 6.1.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'context' Parameter
CWE-862
Medium · CVSS 4.3
EPSS 0.3%2026-08-16
Kirki <= 6.1.1 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameter
CWE-22
Medium · CVSS 4.9
EPSS 0.8%2026-08-16

Track new themeum CVEs as they are disclosed and get AI-written analysis and remediation guidance.

Monitor themeum CVEs

Other vendors

Browse vulnerabilities for other tracked vendors.

Brainstorm Force152 CVEs Squid Cache152 CVEs Docker151 CVEs WSO2151 CVEs Cesanta151 CVEs mandrakesoft151 CVEs checkpoint150 CVEs rubyonrails150 CVEs

Browse all vendors

Frequently asked questions

Common questions about themeum vulnerabilities.

How many CVEs does themeum have?: themeum has 150 published CVE records since 2020, including 77 in the last two years.
How many themeum CVEs are in CISA KEV?: None of themeum's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Which themeum products have the most CVEs?: The themeum products with the most published CVEs are Tutor LMS, Tutor LMS – eLearning and online course solution, WP Crowdfunding, Kirki – Freeform Page Builder, Website Builder & Customizer, Qubely.
What are the most common weakness types in themeum CVEs?: themeum's CVEs most often map to these CWE weakness types: CWE-862 (Missing Authorization), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')), CWE-639 (Authorization Bypass Through User-Controlled Key).
Are there public exploits for themeum vulnerabilities?: Yes — 25 of themeum's CVEs have a known public exploit.
How many critical themeum vulnerabilities are there?: themeum has 8 critical and 39 high-severity CVEs.
What is the average severity of themeum CVEs?: The average CVSS base score across themeum's scored CVEs is 6.4.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track themeum vulnerabilities

Monitor new themeum vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing