Themeum
76 CVEs tracked since 2021. Since Apr 2021, none of them reached CISA KEV.
Themeum CVEs per month
| Month | CVEs | In CISA KEV |
|---|---|---|
| 2021-04 | 9 | 0 |
| 2021-05 | null or fewer | |
| 2021-06 | null or fewer | |
| 2021-07 | null or fewer | |
| 2021-08 | null or fewer | |
| 2021-09 | null or fewer | |
| 2021-10 | null or fewer | |
| 2021-11 | null or fewer | |
| 2021-12 | null or fewer | |
| 2022-01 | null or fewer | |
| 2022-02 | null or fewer | |
| 2022-03 | null or fewer | |
| 2022-04 | null or fewer | |
| 2022-05 | null or fewer | |
| 2022-06 | null or fewer | |
| 2022-07 | null or fewer | |
| 2022-08 | null or fewer | |
| 2022-09 | null or fewer | |
| 2022-10 | null or fewer | |
| 2022-11 | null or fewer | |
| 2022-12 | null or fewer | |
| 2023-01 | null or fewer | |
| 2023-02 | null or fewer | |
| 2023-03 | null or fewer | |
| 2023-04 | null or fewer | |
| 2023-05 | null or fewer | |
| 2023-06 | null or fewer | |
| 2023-07 | null or fewer | |
| 2023-08 | null or fewer | |
| 2023-09 | null or fewer | |
| 2023-10 | null or fewer | |
| 2023-11 | null or fewer | |
| 2023-12 | null or fewer | |
| 2024-01 | null or fewer | |
| 2024-02 | null or fewer | |
| 2024-03 | null or fewer | |
| 2024-04 | null or fewer | |
| 2024-05 | 7 | 0 |
| 2024-06 | null or fewer | |
| 2024-07 | 5 | 0 |
| 2024-08 | 7 | 0 |
| 2024-09 | null or fewer | |
| 2024-10 | null or fewer | |
| 2024-11 | 5 | 0 |
| 2024-12 | 5 | 0 |
| 2025-01 | null or fewer | |
| 2025-02 | null or fewer | |
| 2025-03 | null or fewer | |
| 2025-04 | null or fewer | |
| 2025-05 | null or fewer | |
| 2025-06 | null or fewer | |
| 2025-07 | null or fewer | |
| 2025-08 | null or fewer | |
| 2025-09 | null or fewer | |
| 2025-10 | null or fewer | |
| 2025-11 | null or fewer | |
| 2025-12 | null or fewer | |
| 2026-01 | 7 | 0 |
| 2026-02 | null or fewer | |
| 2026-03 | null or fewer | |
| 2026-04 | 7 | 0 |
| 2026-05 | null or fewer | |
| 2026-06 | null or fewer | |
| 2026-07 | 16 | 0 |
| 2026-08 | null or fewer | |
| 2026-09 | 8 | 0 |
Products
The products that kept showing up in Themeum's monthly top three, with their CVEs summed over those months.
Latest CVEs
The 15 most recently published vulnerabilities affecting Themeum.
- CVE-2026-18335Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Unauthenticated Blind Server-Side Request Forgery via 'kirki_data' Parameter5.4
- CVE-2026-18439Tutor LMS <= 4.0.7 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via 'payload' Parameter4.3
- CVE-2026-89081Tutor LMS <= 4.0.8 - Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters6.1
- CVE-2026-88944Tutor LMS <= 4.0.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id' Parameter4.3
- CVE-2026-89333Tutor LMS <= 4.0.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameter6.5
- CVE-2026-92465WordPress WP Mega Menu plugin <= 1.4.2 - SQL Injection vulnerability7.6
- CVE-2026-78175Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution8.8
- CVE-2026-17037Kirki <= 6.2.0 - Unauthenticated Stored Cross-Site Scripting via 'comment' Parameter7.2
- CVE-2026-19945WP Crowdfunding <= 2.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'first_name' Parameter6.4
- CVE-2026-19944WP Crowdfunding <= 2.2.1 - Authenticated (Shop Manager+) SQL Injection via 'wpneo_reward' Post Meta4.9
- CVE-2026-16759Tutor LMS <= 4.0.5 - Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters6.5
- CVE-2026-66629WordPress Kirki plugin <= 6.2.3 - Cross Site Scripting (XSS) vulnerability7.1
- CVE-2026-18347Kirki <= 6.1.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'context' Parameter4.3
- CVE-2026-17604Kirki <= 6.1.1 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameter4.9
- CVE-2026-16974Kirki - Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_meta Shortcode6.4
The record
- Peak rank
- #59 in Apr 2021
- Busiest month shown
- Jul 2026, 16 CVEs
- Months with a KEV entry
- 0 since Apr 2021
- Monthly snapshots
- 10 since 2021