T
Vendor security profile
themeum
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs21
Critical0
CISA KEV0
Public exploit0
Patch rate%5
Avg. CVSS6.1
12-month vulnerability rate
0
0
0
0
0
0
0
0
0
6
8
5
CVE KEV
CVE severity distribution
21toplam CVE
High7 (33%)
Medium14 (67%)
Patch and exploitation view
%5
Verified patch
%0
CISA KEV
%0
Public exploit
1Patch available
0Partial
0Workaround
0Vendor: no patch
20Unknown
Latest vulnerabilities
7.1
CVE-2026-42702
WordPress Tutor LMS plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability
T
Patch status unknownEPSS %0
5.4
CVE-2026-102291
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'display_name'
T
Patch status unknownEPSS %0
5.3
CVE-2026-42698
WordPress Tutor LMS plugin <= 4.1.1 - Race Condition vulnerability
T
Patch status unknownEPSS %0
7.2
CVE-2026-102173
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Unauthenticated Stored Cross-Site Scripting via Registration Metadata
T
Patch status unknownEPSS %0
8.2
CVE-2026-103065
WordPress Kirki plugin <= 6.3.1 - Arbitrary Code Execution vulnerability
T
Patch status unknownEPSS %0
5.4
CVE-2026-18335
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Unauthenticated Blind Server-Side Request Forgery via 'kirki_data' Parameter
T
Patch status unknownEPSS %0
4.3
CVE-2026-18439
Tutor LMS <= 4.0.7 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via 'payload' Parameter
T
Patch status unknownEPSS %0
6.1
CVE-2026-89081
Tutor LMS <= 4.0.8 - Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters
T
Patch status unknownEPSS %0
4.3
CVE-2026-88944
Tutor LMS <= 4.0.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id' Parameter
T
Patch status unknownEPSS %0
6.5
CVE-2026-89333
Tutor LMS <= 4.0.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameter
T
Patch status unknownEPSS %0