Themeum
Monthly
Broken object-level access control in the Kirki plugin for WordPress before 6.4.1 lets any user who holds Kirki edit access - granted to the Editor role by default - rewrite the title, slug and post_status of arbitrary non-trashed posts, including custom post types and WooCommerce products they do not own, exposing private or draft content or silently unpublishing live content. The PUT /wp-json/kirki/v1/pages/{page_id} route and the save_page_data, duplicate and delete handlers in PageController.php apply only a coarse role-to-access middleware check and never perform a per-object WordPress capability check. Exploitation requires an authenticated account with Kirki edit access (CVSS vector PR:L); no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the vendor has released 6.4.1, so remediation is prioritized for this week rather than treated as an emergency.
Unauthenticated sensitive data exposure in the Themeum WP Crowdfunding plugin affects versions up to and including 2.2.2, allowing remote attackers to read confidential information from WordPress sites where the plugin is active. The CVSS 3.1 score is 7.5 with confidentiality-only impact (C:H/I:N/A:N), and the vector requires no authentication or user interaction. No CISA KEV entry and no public exploit code are identified in the available data; no public exploit identified at time of analysis, and priority is assessed as this_week.
Unauthenticated cross-site scripting in WP Crowdfunding 2.2.2 and earlier lets remote attackers inject script that executes in a victim's browser when the victim is induced to load a crafted request. The flaw is rated CVSS 7.1 (CWE-79) and requires user interaction, so delivery depends on phishing or similar lures; no public exploit was identified at time of analysis, and it is not in CISA KEV. The vuln.today framework assigns this_week priority, and upgrading beyond 2.2.2 is the remediation path.
Privilege escalation in the Kirki plugin for WordPress (all versions up to and including 6.2.5) allows authenticated users with only Subscriber-level access to reach a vulnerable deserialization path in the 'get-single-symbol' branch of the kirki_post_apis() AJAX dispatcher, which lacks a capability check, and to inject a PHP object. Because a POP chain is present in the running code, a successful injection can overwrite an administrator's password and hand the attacker full administrative control of the site. The CVSS vector confirms network reachability, low privileges (PR:L), and no user interaction (UI:N) for a high-integrity, high-availability impact; EPSS is low at 0.30% (23rd percentile) and there is no KEV listing, so there is no public exploit identified at time of analysis, though the practical exposure is governed by whether a site permits open user registration.
PHP Object Injection in the Kirki WordPress plugin through 6.3.2 allows an authenticated Editor-level user to submit serialized data to the template import endpoint, but real impact is conditional on another installed plugin or theme providing a usable POP chain. Kirki itself contains no gadget chain, so the flaw alone does not enable file deletion, data theft, or code execution; the supplied 7.2 score overstates immediate risk, and no public exploit was identified at time of analysis. By default, KIRKI_USERS_DEFAULT_FULL_ACCESS lets Editors reach the endpoint despite the PR:H vector.
Unauthenticated information disclosure in the Kirki - Freeform Page Builder, Website Builder & Customizer plugin for WordPress through 6.3.2 allows remote attackers to read arbitrary users’ profile data by manipulating the 'context' parameter. The flaw is exploitable only when a published page uses a Kirki template containing at least one user-type dynamic content block, but under that condition no authentication or user interaction is needed and user IDs can be enumerated through standard WordPress REST endpoints. Impact is limited to disclosure of string-valued profile and user-meta fields, with no integrity or availability effect; no public exploit code was identified at time of analysis.
Unauthenticated remote attackers can force-publish, rewrite, and create the managed pages of any WordPress site running Tutor LMS below 4.1.1, because the plugin's page-regeneration routine omits a capability check (CWE-862). Impact is confined to integrity - unpublished pages can be pushed live, existing page content overwritten, missing pages created, and the plugin options that reference those pages changed - with no confidentiality or availability effect and no code execution, so realistic damage is content tampering and manipulation of plugin page references rather than site takeover. Publicly available exploit code exists, and the CVSS 3.1 base score is 7.5 (HIGH) with vector AV:N/AC:L/PR:N/UI:N, making it trivially reachable on exposed sites; there is no CISA KEV entry indicating confirmed active exploitation at time of analysis.
Cross-site scripting in Tutor LMS 4.1.0 and earlier allows unauthenticated remote attackers to inject script into pages viewed by victims, but exploitation requires a victim to interact with attacker-supplied content. Successful attacks execute JavaScript in the victim’s browser context with low confidentiality, integrity, and availability impact, potentially enabling session theft or unauthorized actions on behalf of an administrator or instructor. The provided data identifies no public exploit code and no confirmed active exploitation; the Patchstack advisory is the primary reference.
Stored cross-site scripting (XSS) in the Kirki - Freeform Page Builder, Website Builder & Customizer WordPress plugin through version 6.3.1 allows unauthenticated attackers to inject arbitrary web scripts into registration metadata that executes when a user views a page rendering a Kirki users collection with an image element bound to one of nine registration meta fields. Exploitation requires that public user registration is enabled, that a published page contains a `kirki-register` element (which exposes the necessary nonce in public markup), and that an image element is bound to a registration meta field; default installations without open registration are not affected. A vendor patch is available in version 6.3.2, and no public exploit code has been identified at the time of analysis.
Improper input validation in the Themeum Kirki WordPress plugin through version 6.3.1 allows unauthenticated remote attackers to access functionality not properly constrained by ACLs, yielding high confidentiality impact and low integrity impact with no availability impact. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N (base 8.2) confirms network exploitation without privileges or user interaction, so any WordPress site running Kirki from initial release through 6.3.1 is exposed. No public exploit identified at time of analysis, though the Patchstack reference URL labels the issue as arbitrary code execution; the authoritative assessment aligns with CWE-1284 broken access control rather than a confirmed RCE outcome.
Blind SQL injection in Themeum's WP Mega Menu WordPress plugin (versions through 1.4.2) allows an attacker who already holds a high-privilege, administrator-level account to feed crafted input into a vulnerable plugin parameter that is not neutralized before reaching a SQL query, letting them infer database contents one query at a time. Exploitation is privilege-gated (CVSS PR:H) and the injection is blind, so extraction is slow and no anonymous or low-privileged user can reach it; user interaction is not required (UI:N). The CVE carries a CVSS 3.1 base score of 7.6, but the effective risk is lower than that number implies given the authentication prerequisite, and no public exploit code has been identified at time of analysis.
Remote code execution is achievable in Tutor LMS WordPress plugin (≤4.0.7) via a PHP Object Injection flaw in the withdrawal account AJAX handler that exploits a subtle interaction between `esc_sql()` percent-escaping and PHP serialized string-length declarations. Authenticated attackers with subscriber-level access — or unauthenticated attackers on sites with user registration enabled, the typical eLearning configuration — can inject an arbitrary serialized object stream and trigger the well-documented `GuzzleHttp\Cookie\FileCookieJar` POP chain to write a webshell to an attacker-specified path. No public exploit or KEV listing is confirmed at time of analysis, but a fix changeset is available and the POP chain is reliably reachable due to the plugin's bundled PayPal Composer autoloader.
Stored Cross-Site Scripting in the Kirki - Freeform Page Builder, Website Builder & Customizer WordPress plugin (all versions through 6.2.0) allows unauthenticated attackers to permanently embed malicious JavaScript into pages via the unsanitized 'comment' parameter. Injected payloads persist in the database and execute in every subsequent visitor's browser session, enabling session hijacking, credential theft, or privilege escalation against logged-in administrators who view the affected pages. No public exploit or CISA KEV listing has been identified at time of analysis, but the unauthenticated write vector makes mass-exploitation trivially automatable across unpatched WordPress installations.
Unauthenticated cross-site scripting (XSS) in the Kirki WordPress customizer plugin (all versions up to and including 6.2.3) allows remote, unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser when the victim is socially engineered into visiting a crafted URL or page. The CVSS scope change (S:C) indicates injected script execution escapes the plugin's own context, enabling session hijacking, credential theft, or unauthorized admin actions against authenticated WordPress users. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the zero-privilege-required, low-complexity attack path makes this accessible to unsophisticated attackers targeting WordPress sites.
Object injection in the Themeum Kirki WordPress customizer framework (all versions through 6.0.12) allows attackers to abuse PHP deserialization of untrusted data (CWE-502), potentially leading to arbitrary object instantiation and, given a suitable POP gadget chain, remote code execution or full site compromise. Reported by Patchstack with a maximum CVSS 9.8 rating; no public exploit identified at time of analysis and the flaw is not listed in CISA KEV. Because Kirki is a developer toolkit bundled into many premium WordPress themes, exposure depends on which theme/plugin code passes attacker-controllable input into its deserialization path.
Stored cross-site scripting in the Themeum Kirki WordPress customizer framework (versions through 6.0.11) lets an attacker persist malicious script that executes in the browsers of users who later view the affected page or admin screen. Because the CVSS scope is marked changed (S:C), a successful payload can act beyond the vulnerable component's boundary, affecting whoever renders the stored input. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Blind SQL injection in the Themeum Kirki WordPress customizer framework (all versions up to and including 6.0.12) lets remote attackers inject SQL through improperly neutralized special elements, per the CVSS PR:N vector without authentication, to infer and extract database contents. The scope-changed CVSS 3.1 score of 9.3 reflects impact reaching beyond the plugin's own security boundary into the wider WordPress database. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Broken access control in the Themeum Kirki WordPress customizer framework (versions up to and including 6.0.13) allows remote unauthenticated attackers to reach functionality protected by incorrectly configured access-control levels, resulting in disclosure of sensitive information. The flaw was reported by Patchstack and stems from a missing authorization check (CWE-862); no public exploit has been identified at time of analysis. With a CVSS of 7.5 driven purely by confidentiality impact, the practical risk is unauthorized data exposure rather than site takeover.
SQL injection in Tutor LMS Pro (Themeum) versions 3.9.6 and earlier allows remote unauthenticated attackers to inject arbitrary SQL against the underlying WordPress database. The CVSS 9.3 rating reflects a scope change with high confidentiality impact, meaning data accessible to the WordPress backend can be exposed. As of analysis, no public exploit identified at time of analysis, and the issue is tracked via Patchstack.
Unauthenticated local file inclusion in the Themeum Right Way WordPress theme versions 4.0 and earlier allows remote attackers to include arbitrary local files and likely achieve code execution through PHP file inclusion (CWE-98). The flaw is network-reachable without credentials, though CVSS records high attack complexity (AC:H), and no public exploit has been identified at time of analysis. The advisory is sourced from Patchstack's WordPress vulnerability database.
Reflected cross-site scripting in the Skillate WordPress theme versions 1.2.10 and below allows remote unauthenticated attackers to inject arbitrary JavaScript that executes in a victim's browser when they interact with a crafted link. The flaw carries a CVSS 3.1 score of 7.1 with scope change (S:C), reflecting that the injected script runs in the WordPress site context and can pivot against authenticated users including administrators. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Account takeover in the Kirki Freeform Page Builder WordPress plugin (versions 6.0.0 through 6.0.6) allows unauthenticated remote attackers to hijack any registered account, including administrators, by redirecting password reset links to attacker-controlled email addresses. The flaw stems from the plugin honoring an arbitrary email value supplied alongside a valid username in password reset requests, breaking the trust binding between account and recovery destination. No public exploit identified at time of analysis, but the trivial nature of the bug and Wordfence's published advisory make weaponization straightforward.
Arbitrary file read and deletion in the Kirki - Freeform Page Builder plugin for WordPress (versions through 6.0.6) allows unauthenticated remote attackers to read and delete files within the WordPress uploads base directory by abusing the 'downloadZIP' function. The flaw stems from insufficient path validation and a missing capability check, and was reported by Wordfence; no public exploit identified at time of analysis.
Unauthenticated attackers can overwrite billing profile data (name, email, phone, address) for any WordPress user with an incomplete manual order in Tutor LMS plugin versions ≤3.9.7. The pay_incomplete_order() function accepts attacker-controlled order_id parameters without identity verification, writing billing fields directly to the order owner's profile. Exploitation is simplified by predictable Tutor nonce exposure on public pages, enabling targeted profile manipulation via crafted POST requests with enumerated order IDs. No public exploit or active exploitation confirmed at time of analysis.
Authentication bypass in Tutor LMS Pro WordPress plugin (versions through 3.9.4) allows remote attackers to abuse authentication mechanisms via alternate paths, potentially gaining unauthorized administrative access. CVSS 8.1 reflects high attack complexity (AC:H) requiring specific conditions, yet successful exploitation grants complete system compromise (C:H/I:H/A:H). EPSS probability of 0.02% (6th percentile) indicates low observed exploitation activity. No active exploitation confirmed by CISA KEV. SSVC framework classifies this as non-automatable with total technical impact, making it a priority for organizations running this WordPress LMS plugin despite low real-world exploitation signals.
Authenticated low-privilege users can inject script-related HTML into WordPress sites running Themeum Kirki 6.4.0 or earlier, producing a basic XSS condition. The authoritative assessment rates it medium severity with vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N and notes that a second user, typically an administrator, must view the affected page for a stored payload to execute; the specific injection point is not described in the available sources. No public exploit identified at time of analysis, and there is no CISA KEV confirmation.
Stored cross-site scripting in Themeum Tutor LMS through 4.1.2 lets an authenticated low-privilege user, such as an instructor or student able to submit stored content, persist script that executes when another user views the affected page. The plugin does not properly neutralize input during web page generation (CWE-79), and exploitation also requires victim interaction, so sites with open registration or broad Tutor LMS role assignment face greater exposure. The issue is rated CVSS 6.5, and no public exploit was identified at time of analysis.
Insecure direct object reference in the Tutor LMS WordPress plugin (all versions up to and including 4.1.0) allows any authenticated user holding instructor/author-level capability to take over and overwrite courses belonging to other instructors. Because the course-save routine passes attacker-controlled POST data into wp_insert_post() without stripping the 'ID' key, a non-empty ID is interpreted by WordPress as an update to an existing post, letting the attacker change the victim course's title, content and status and reassign its ownership to themselves. Authentication with at least author-level access is required (CVSS PR:L) and there is no unauthenticated path; no public exploit code was identified at time of analysis and the issue is not in CISA KEV, but sites that grant the instructor role to untrusted or numerous users - multi-instructor marketplaces and open registration setups - carry real content-integrity risk, while single-author sites are effectively unexposed.
Stored cross-site scripting in the Tutor LMS - eLearning and Online Course Solution WordPress plugin (all versions up to and including 4.1.0) allows an authenticated attacker with subscriber-level access or above to inject arbitrary JavaScript via the display_name parameter, which is insufficiently sanitized on input and not escaped on output. The payload is only stored and rendered when a Legal Consent record exists for the attacker's account, causing a 'View Logs' button to appear in the Consent Logs column of wp-admin/users.php; an administrator or other privileged user must then open that page for the script to execute, so exploitation is gated on consent logging being enabled and on a privileged user visiting the affected admin screen. Rated CVSS 6.4 (CWE-79), this is a moderate-severity issue with no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, though the Subscriber-level prerequisite is trivially met on sites with open user registration.
DOM-based cross-site scripting in the Tutor LMS eLearning and online course plugin for WordPress (versions up to and including 4.0.8) lets unauthenticated attackers inject arbitrary JavaScript that runs in a victim's browser when the crafted 'redirect_url' parameter is processed by the Topbar component's back-button handler. Because the CVSS vector carries UI:R, the attacker must convince a victim to open a specially crafted URL and trigger the back-button action - the flaw cannot be exploited passively against a server, and no public exploit code has been identified at time of analysis. Scored 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) and assessed as a moderate-severity client-side issue rather than a top-tier priority, it still allows session-scoped script execution and potential redirect or content-injection abuse on any WordPress site running the affected plugin version.
Stored cross-site scripting in the Kirki - Freeform Page Builder, Website Builder & Customizer plugin for WordPress (all versions up to and including 6.2.0) lets an authenticated user who has been granted the administrator-controlled kirki_content_access capability save arbitrary JavaScript through the Page Builder Text Content field, which then executes in the browser of any user who later views the injected page. Exploitation requires that capability grant, which is a non-default, elevated content permission rather than a standard subscriber or author role, and the stored payload only fires on a subsequent victim page view; upgrading to 6.2.1 removes the flaw. No public exploit code, proof-of-concept, or CISA KEV entry has been identified at the time of analysis, and this rates as a moderate, not high-urgency, issue.
Reflected cross-site scripting in the Tutor LMS - eLearning and online course solution WordPress plugin affects all versions up to and including 4.1.0, allowing unauthenticated attackers to inject arbitrary web scripts through the 'tab' parameter. Exploitation requires user interaction (a victim clicking an attacker-supplied link), and the CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N, base 4.7 Medium) reflects real but constrained risk: the payload only reaches the output sink on lesson pages where the nav-items array is empty, which occurs when a lesson has no post content, no attachments, and comments are disabled or the viewer is not logged in. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis.
Arbitrary shortcode execution in the Kirki - Freeform Page Builder, Website Builder & Customizer plugin for WordPress (all versions up to and including 6.3.1) lets any authenticated user with Subscriber-level access or above inject shortcodes by writing them into their own `display_name` profile field, which the plugin splices unfiltered into composed page markup and then passes through `do_shortcode()`. The flaw is exploitable as a remote, network-reachable issue requiring only a low-privileged account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, 5.4), rated moderate by the independent assessment; the key precondition is that a published page must exist containing a Kirki element whose dynamic content is explicitly bound to the `display_name` user field - typically a team or member-directory / users-collection page - and on sites without such a page the vulnerable code path is never reached. Where that binding does exist, the injected shortcode executes in the request of every visitor, including unauthenticated ones, so per-victim interaction is not required; no public exploit code or confirmed active exploitation was identified at time of analysis.
Race condition in the WordPress plugin Tutor LMS (Themeum) affecting versions through 4.1.1 lets an authenticated attacker with low privileges exploit improper synchronization of a shared resource by firing overlapping concurrent requests in order to win a timing window, with the assessed impact limited to integrity (CVSS 5.3, CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N). Because exploitation requires a valid low-privileged account and depends on a non-deterministic concurrency race (AC:H, SSVC Exploitation: none, Automatable: no), successful abuse is probabilistic rather than reliable. There is no public exploit identified at time of analysis and no CISA KEV listing, so this is a genuine but moderate-priority issue for sites exposing Tutor LMS to registered users rather than an emergency.
Blind server-side request forgery in the Kirki - Freeform Page Builder, Website Builder & Customizer plugin for WordPress, affecting all versions up to and including 6.2.0, allows unauthenticated remote attackers to make the WordPress server issue HTTP requests to arbitrary locations by supplying an attacker-controlled URL in the 'kirki_data' parameter. Because the SSRF is blind (no response body is returned to the attacker), exploitation is assessed as high-complexity: the attacker must already know or correctly guess reachable internal hosts or services, so the practical impact is limited to internal service enumeration, state-changing requests against unauthenticated internal endpoints, and access to cloud instance-metadata addresses that the host can reach. There is no public exploit identified at time of analysis and the vulnerability is not confirmed actively exploited (CISA KEV), making this a moderate-risk, not top-priority, issue for most deployments - though it becomes materially more serious on hosts with broad outbound network reachability or attached cloud IAM roles.
Authenticated Instructor-level users on WordPress sites running the Tutor LMS plugin 4.0.7 or earlier can overwrite, re-parent, or delete quiz question and answer rows belonging to other instructors and administrators by abusing broken ownership checks in the tutor_quiz_builder_save AJAX action. The handler validates only the top-level course_id/topic_id and payload['ID'], then passes attacker-supplied nested question_id, answer_id, deleted_question_ids[], and deleted_answer_ids[] values straight into $wpdb->update and DELETE statements, so an Instructor who controls one course can reach rows owned by others. Impact is limited to integrity of quiz content (CVSS 3.1 base 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) and is only meaningful on multi-instructor or multi-tenant course sites; there is no public exploit code identified at time of analysis and no confirmed active exploitation (not in CISA KEV), and the Instructor privilege prerequisite is the main factor bounding realistic risk. A vendor fix is available in Tutor LMS 4.0.8.
Reflected cross-site scripting in the Tutor LMS WordPress plugin (all versions up to and including 4.0.8) lets unauthenticated attackers craft links whose 'search' parameter injects arbitrary JavaScript into the victim's browser when the dashboard or account search flow is rendered. Exploitation requires the victim to click the crafted link (CVSS 3.1 base 6.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), so the payload never self-triggers, and no public exploit code or confirmed active exploitation was identified at time of analysis. Although any site visitor can be targeted, the practical payoff is highest when an authenticated or privileged user such as an instructor, administrator, or student is lured into clicking, because the script then executes inside that user's session context and can act on their behalf within the WordPress site.
Authenticated users holding only subscriber-level access can permanently delete arbitrary WordPress posts - pages, courses, quizzes, and WooCommerce products - on sites running the Tutor LMS plugin through version 4.0.8. The flaw is an authorization bypass: a lesson-deletion handler reaches wp_delete_post( $id, true ) without verifying the caller has capability over the target post, and the multi-stage exploit chain (create an authored attachment via the profile-photo upload flow, create a Tutor topic reparented to that attachment, then invoke the deletion handler) is required to satisfy the plugin's ownership checks. Wordfence reports it, vendor code changesets are referenced, and no public exploit code or confirmed active exploitation was identified at time of analysis; scored 4.3 by the reporter and assessed by our team as AC:H with moderate-to-low real-world risk, since authentication is mandatory and impact is limited to destructive integrity loss rather than code execution or data exfiltration.
Tutor LMS WordPress plugin versions up to 4.0.8 expose arbitrary users' email addresses and Tutor profile phone numbers to any logged-in subscriber-level attacker through an insecure direct object reference in the student_id parameter. This moderate-priority CWE-639 flaw requires only an authenticated account; open registration on LMS/course sites makes that precondition easy to meet, but exploitation is limited to confidentiality of those fields and does not provide credentials, write access, or code execution. No public exploit code or confirmed active exploitation was identified at time of analysis, and our independent assessment rates confidentiality impact as Low under CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.
Stored Cross-Site Scripting in the WP Crowdfunding WordPress plugin (≤2.2.1, by Themeum) allows authenticated subscribers to inject persistent JavaScript via the `first_name` parameter in the plugin's user profile dashboard. When an administrator views the attacker's user profile via the `?show_user_id=` URL parameter, the payload executes in the admin's browser session, enabling cross-privilege script execution from a subscriber-level account to an administrative context. No public exploit code has been identified and the CVE is absent from CISA KEV, though a patch commit exists in the plugin SVN repository.
Second-order SQL injection in the WP Crowdfunding WordPress plugin by Themeum (versions ≤2.2.1) enables authenticated shop managers to exfiltrate arbitrary database contents. The attack is split across two phases: the attacker writes a malicious payload once to the `wpneo_reward` post meta via the WooCommerce REST API, and the unsanitized value is then injected into a live SQL query on every subsequent public page view that renders the campaign rewards sidebar - making the extraction persistent and silent. No public exploit or KEV listing is identified at time of analysis, but the high confidentiality impact (C:H) and persistent execution model elevate practical risk beyond the CVSS 4.9 base score.
Unauthenticated remote PHP function invocation in the Tutor LMS WordPress plugin (all versions up to and including 4.0.5) allows any internet-accessible attacker to call arbitrary zero-argument PHP functions server-side via a missing-authorization AJAX handler combined with extract()-based variable injection into a template scope. The most critical demonstrated impact is persistent subscriber-level account creation through WordPress core's edit_user() function, which reads POST parameters directly, enabling unauthenticated user registration on any affected site. No CISA KEV listing has been identified at time of analysis, but Wordfence's detailed technical disclosure with specific file paths and line numbers substantially lowers the barrier for independent exploit development against the 6.5 CVSS-rated but trivially accessible unauthenticated attack surface.
Insecure Direct Object References in WP Crowdfunding (Themeum) versions prior to 2.2.1 allow authenticated subscriber-level users to access campaign objects, donor records, or financial data they are not authorized to view. The vulnerability, discovered and reported by Patchstack, stems from missing authorization checks on direct object references within the plugin, enabling lateral data exposure across campaigns or users. No public exploit or active exploitation has been identified at time of analysis, and a vendor patch is available.
Authorization bypass in the Kirki Freeform Page Builder, Website Builder & Customizer plugin for WordPress (all versions through 6.1.1) exposes arbitrary user metadata - including email addresses, assigned roles, registration dates, and all user_meta values - to any authenticated user with custom-level access or above. The flaw is rooted in the plugin's frontend collection REST endpoint failing to verify that the requesting user is authorized to retrieve records for the specified target user ID. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, but the low access barrier (any WordPress account qualifies) makes it a realistic risk on sites with open or attacker-controlled user registration.
Directory traversal in the Kirki WordPress plugin (all versions through 6.1.1) allows authenticated attackers with editor-level access to read arbitrary files on the server by exploiting a flawed strpos()-based path validation guard in the plugin's AJAX ExportImport handler. By crafting a 'data' parameter value that embeds the uploads directory path as a substring while appending directory traversal sequences, an attacker can escape the intended upload directory restriction and retrieve sensitive files such as wp-config.php containing database credentials and secret keys. No active exploitation has been confirmed and no CISA KEV listing exists; the CVSS score of 4.9 (Medium) reflects the high privilege requirement, though the confidentiality impact is rated High due to the severity of files that can be exposed as a precursor to full site compromise.
Stored cross-site scripting in Themeum's Kirki Freeform Page Builder plugin (all versions through 6.2.0) allows WordPress users holding Contributor-level access to inject persistent malicious scripts via the post_meta shortcode, which then execute in the browser of any subsequent visitor to the compromised page. The CVSS scope change (S:C) signals that the impact crosses from the contributor's own session boundary into victim sessions, enabling session hijacking, credential exfiltration, or privilege escalation toward site administration. A fix commit is available in the WordPress plugin repository (changeset 3636487), and no public exploit code or CISA KEV listing has been identified at time of analysis.
Zip Slip path traversal in the Kirki WordPress plugin (all versions through 6.0.13) enables authenticated attackers with custom-level access or above to write arbitrary files anywhere on the server, leading to remote code execution. The root cause is the plugin's app installation and update workflows - install_app, update_app, and get_kirki_template_from_zip - which fetch a user-supplied external ZIP URL via an unsanitized app src parameter and extract its contents without validating entry names for path-traversal sequences. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the write-to-RCE escalation path is mechanically straightforward once the authentication bar is cleared.
Administrator-level SQL injection in the Tutor LMS plugin for WordPress versions ≤4.0.1 permits extraction of sensitive database contents via the coupon_code parameter. The vulnerability requires high privileges but low attack complexity, and no public exploitation or exploit code is currently known.
Unauthorized content disclosure in the Kirki - Freeform Page Builder plugin for WordPress (all versions ≤ 6.0.14) allows unauthenticated remote attackers to read the full title, body, and excerpt of any WordPress post by supplying an arbitrary post ID via the unvalidated `context` parameter in the plugin's frontend REST API. Affected content includes drafts, pending posts, privately published posts, password-protected posts, and trashed posts - bypassing all native WordPress visibility controls. No active exploitation confirmed (not in CISA KEV), and no public POC is identified at time of analysis, but the attack requires zero authentication and low complexity per the CVSS vector.
Broken access control in the Qubely WordPress Gutenberg block plugin (versions up to and including 1.8.14) allows unauthenticated remote attackers to bypass authorization checks and perform restricted actions, resulting in limited confidentiality and integrity compromise. The vulnerability stems from missing authorization enforcement (CWE-862) on one or more plugin endpoints exposed to the network. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS vector reflects high attack complexity, tempering real-world risk below what the unauthenticated access vector alone might suggest.
Missing capability checks in the Tutor LMS Elementor Addons WordPress plugin (Themeum) allow any authenticated WordPress user with Subscriber-level access or higher to activate the Tutor LMS and Elementor plugins without administrative authorization. Affected are all versions through 4.0.0, confirmed by Wordfence threat intelligence. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, and real-world impact is constrained by the requirement for a valid WordPress account.
Directory traversal via the unsanitized 'family' parameter in the Kirki plugin for WordPress (all versions up to and including 6.0.13) enables authenticated users holding editor-level access or above to delete arbitrary directories on the server filesystem, risking data loss and site unavailability. Reported by Wordfence, the flaw originates in insufficient path validation within FontService.php and GlobalDataController.php, which process the 'family' parameter without canonicalization or boundary enforcement. No public exploit code exists and no CISA KEV listing is present at time of analysis, but the potential for irreversible filesystem destruction makes this a meaningful risk on any WordPress site granting editor access to untrusted accounts.
Insecure Direct Object Reference (IDOR) in Tutor LMS WordPress plugin allows authenticated low-privilege users to bypass authorization controls by manipulating user-controlled keys, resulting in unauthorized modification of LMS objects such as courses, lessons, or student records. Affected versions span all releases through 3.9.13 by Themeum. No confirmed active exploitation (KEV) or public exploit code has been identified at time of analysis, but the low attack complexity and wide WordPress deployment surface make this a credible integrity risk for any site running an unpatched version.
Unauthenticated IDOR in the Kirki WordPress customizer toolkit (versions <= 6.0.11) allows remote unauthenticated attackers to reference and manipulate object identifiers they do not own, resulting in unauthorized modification of data and limited availability disruption. The vulnerability carries no confidentiality impact per the CVSS vector (C:N), but the combination of network-exploitability with zero authentication requirements (AV:N/AC:L/PR:N/UI:N) makes it trivially accessible to any internet-facing WordPress installation running an affected version. No public exploit code or CISA KEV listing has been identified at the time of analysis.
Authorization bypass in the Kirki Freeform Page Builder plugin for WordPress (all versions through 6.0.11) enables unauthenticated remote attackers to trigger arbitrary HTML-injected emails to any registered user via the site's own mail infrastructure. Because the email is dispatched through the site's authenticated SMTP path, it inherits the domain's SPF and DKIM reputation, substantially increasing phishing credibility. Critically, attackers can embed a genuine, site-generated WordPress password-reset URL for the target account inside an attacker-controlled HTML body, creating a highly convincing credential-harvesting lure. No public exploit or CISA KEV listing is confirmed at time of analysis.
Unauthenticated sensitive information exposure in the Kirki - Freeform Page Builder, Website Builder & Customizer WordPress plugin (versions through 6.0.11) permits any remote attacker to retrieve the full builder metadata and rendered HTML of any kirki_symbol post - including unpublished drafts - by issuing a crafted AJAX request with a sequential WordPress post ID. The root cause is a missing authorization check (CWE-862) in the get_single_symbol AJAX handler registered in includes/Ajax.php, confirmed by Wordfence. No active exploitation is confirmed in CISA KEV, and no EPSS data was provided, but the trivially automatable nature of post ID enumeration against an unauthenticated network endpoint elevates practical risk above the raw CVSS 5.3 score suggests.
Stored Cross-Site Scripting in Tutor LMS (WordPress plugin by Themeum) versions through 3.9.13 allows authenticated attackers holding author-level or higher WordPress roles to inject persistent malicious scripts via the Lesson Attachment Title field. The injected payload is stored in the WordPress database and executes in the browser of any user who subsequently accesses a course page rendering the attachment - achieving a scope change from the plugin's context into the victim's browsing session. No public exploit code or CISA KEV listing has been identified at time of analysis, but the Wordfence disclosure includes direct source-code references to the vulnerable rendering path, lowering the barrier to exploitation.
SQL injection in Tutor LMS (WordPress plugin by Themeum) exposes the underlying database to read-access by any authenticated administrator. The flaw resides in the withdrawal-request management flow - specifically WithdrawModel.php and withdraw_requests.php - where a 'data' parameter is passed to SQL queries without adequate escaping or parameterization. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the data-exposure impact (C:H) is real, and a patched release (3.9.12) is confirmed in the WordPress plugin repository.
Broken access control in Tutor LMS WordPress plugin versions up to and including 3.9.7 permits unauthenticated remote attackers to bypass authorization checks and access or modify restricted LMS resources. The flaw, classified as CWE-862 (Missing Authorization), stems from the plugin failing to enforce appropriate permission checks before executing sensitive operations. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis, though the unauthenticated attack vector and low complexity make this straightforward to exploit opportunistically.
Authorization bypass in the Kirki Freeform Page Builder plugin for WordPress (all versions through 6.0.6) allows authenticated attackers with subscriber-level privileges to enumerate and read all frontend form structures and stored visitor submission data, including contact details and messages submitted through any site form powered by the plugin. The flaw originates in missing authorization checks on an AJAX handler (Ajax.php, line 675), meaning any logged-in user - including the lowest-privilege role WordPress assigns - can exfiltrate sensitive visitor-submitted information without any administrative context. No public exploit or CISA KEV listing has been identified at time of analysis, but the low privilege barrier and network-accessible attack vector make this a realistic data exposure risk for any multi-user or public-registration WordPress site running the affected plugin.
Authenticated instructors in Tutor LMS versions up to 3.9.9 can manipulate course ownership logic via an attacker-controlled GET parameter to perform unauthorized operations on other instructors' courses, including deleting lessons, quizzes, assignments, and student data, or modifying course content and grades. The vulnerability stems from the `get_course_id_by()` function unconditionally trusting user-supplied input instead of validating course ownership, bypassing the plugin's primary authorization gate. No public exploit code or active exploitation has been identified at time of analysis.
Tutor LMS plugin for WordPress versions up to 3.9.8 allow authenticated attackers to manipulate course content structure (detach lessons, move lessons between topics, reorder content) without proper authorization checks when the 'content_parent' parameter is omitted from requests to the tutor_update_course_content_order() function. Although the CVSS score of 5.3 reflects the absence of confidentiality impact, the vulnerability enables course instructors or subscribers to disrupt course integrity across the entire site despite lacking content management permissions, with no public exploit code confirmed but patch available in version 3.9.9.
SQL injection in Tutor LMS plugin for WordPress through version 3.9.8 allows authenticated Admin-level attackers to extract sensitive database information by injecting malicious SQL via the 'date' parameter, which is insufficiently escaped before being interpolated into a SQL fragment passed to $wpdb->prepare(). The vulnerability requires Admin authentication and does not permit data modification or denial of service. CVSS 6.5 reflects confidentiality impact; exploitation is limited to high-privilege authenticated users.
Unauthorized modification of data in Tutor LMS 3.9.7 and earlier allows authenticated attackers with low privileges to exploit missing authorization checks, potentially altering course content or causing limited service disruption. The vulnerability carries a CVSS score of 5.4 but an EPSS score of 0.02% with no known active exploitation or public proof-of
Insecure Direct Object Reference in Tutor LMS WordPress plugin versions up to 3.9.7 allows authenticated Subscriber-level users to manipulate course content structure across any course by exploiting missing authorization checks in the save_course_content_order() method, enabling attackers to detach lessons from topics, reorder course content, and reassign lessons between courses without proper ownership verification.
Tutor LMS plugin for WordPress up to version 3.9.7 allows authenticated subscribers to enroll in private courses due to missing post_status validation in enrollment functions, exposing private course metadata in user dashboards despite WordPress core preventing actual content access. The vulnerability requires subscriber-level authentication but affects confidentiality and integrity, with confirmed patches available in version 3.9.8.
Stored cross-site scripting (XSS) in Themeum Qubely WordPress plugin version 1.8.14 and earlier allows authenticated high-privilege users to inject malicious scripts that execute in the browsers of other site visitors, compromising session integrity and enabling credential theft or malware distribution. The vulnerability requires administrator authentication and user interaction (UI:R), limiting immediate risk, but stored persistence means injected payloads remain active until remediated. EPSS exploitation probability is extremely low at 0.03%, suggesting minimal real-world targeting despite public disclosure.
An authorization bypass vulnerability exists in Themeum Tutor LMS through version 3.9.4 that allows authenticated users to access resources they should not have permission to view through user-controlled keys in the access control mechanism. This Insecure Direct Object Reference (IDOR) vulnerability affects all Tutor LMS installations up to and including version 3.9.4, enabling an attacker with low privileges to read sensitive data by manipulating object identifiers. The vulnerability has a CVSS score of 6.5 reflecting moderate severity with high confidentiality impact, and while no KEV or widespread POC exploitation has been publicly confirmed, the attack requires only network access and valid authentication credentials.
Missing authorization in Droip plugin for WordPress (all versions ≤2.2.6) allows authenticated attackers with Subscriber-level privileges to manipulate content and settings via droip_post_apis() AJAX handler. Exploitable actions include arbitrary post deletion/creation, post duplication, settings modification, and user account manipulation. Requires only low-privilege authenticated access (PR:L) for high-impact compromise of confidentiality, integrity, and availability (CVSS 8.8). No public exploit identified at time of analysis.
Arbitrary file upload in Themeum Droip WordPress plugin (versions up to 2.5.1) permits authenticated attackers with Subscriber-level privileges or higher to upload malicious files without file type validation in the make_google_font_offline() function, enabling remote code execution on the affected server. CVSS 8.8 severity reflects low privilege requirement (PR:L) and complete confidentiality, integrity, and availability impact. No public exploit identified at time of analysis.
The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the download_data action in all versions up to, and including, 2.1.13. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Qubely - Advanced Gutenberg Blocks allows Stored XSS.8.12. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Qubely - Advanced Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ and 'UniqueID' parameter in all versions up to, and including, 1.8.12 due to. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Missing Authorization vulnerability in Themeum WP Crowdfunding wp-crowdfunding allows Exploiting Incorrectly Configured Access Control Security Levels.1.5. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the install_woocommerce_plugin() function action in all versions up to,. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wp-crowdfunding/search block in all versions up to, and including, 2.1.15 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Missing Authorization vulnerability in Themeum Tutor LMS Elementor Addons tutor-lms-elementor-addons.1.5. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via the ‘rating_filter’ parameter in all versions up to, and including, 2.7.6 due to insufficient escaping on the user supplied. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The Tutor LMS plugin for WordPress is vulnerable to bypass to user registration in versions up to, and including, 2.7.6. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the install_etlms_dependency_plugin() function in all. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
Missing Authorization vulnerability in Themeum WP Crowdfunding allows Exploiting Incorrectly Configured Access Control Security Levels.1.10. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in Themeum Tutor LMS allows Exploiting Incorrectly Configured Access Control Security Levels.7.3. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpcf_donate shortcode in all versions up to, and including, 2.1.11 due to insufficient input. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized administrative actions execution due to a missing capability checks on multiple functions like treport_quiz_atttempt_delete and. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unauthenticated path traversal in Themeum's Droip WordPress plugin (versions prior to 2.5.2) lets remote attackers read sensitive files outside the intended directory and trigger availability impact with scope change to the underlying WordPress host. CVSS rates this 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H), and while no public exploit is identified at time of analysis, the EPSS of 1.13% (78th percentile) signals meaningfully elevated exploitation interest relative to the broader CVE population.
Missing Authorization vulnerability in Themeum Droip droip allows Exploiting Incorrectly Configured Access Control Security Levels.5.2. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in Themeum Tutor LMS.7.2. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'course_carousel_skin' attribute within the plugin's Course Carousel widget in all versions up. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS.7.2. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themeum Tutor LMS allows Stored XSS.7.3. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Broken object-level access control in the Kirki plugin for WordPress before 6.4.1 lets any user who holds Kirki edit access - granted to the Editor role by default - rewrite the title, slug and post_status of arbitrary non-trashed posts, including custom post types and WooCommerce products they do not own, exposing private or draft content or silently unpublishing live content. The PUT /wp-json/kirki/v1/pages/{page_id} route and the save_page_data, duplicate and delete handlers in PageController.php apply only a coarse role-to-access middleware check and never perform a per-object WordPress capability check. Exploitation requires an authenticated account with Kirki edit access (CVSS vector PR:L); no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the vendor has released 6.4.1, so remediation is prioritized for this week rather than treated as an emergency.
Unauthenticated sensitive data exposure in the Themeum WP Crowdfunding plugin affects versions up to and including 2.2.2, allowing remote attackers to read confidential information from WordPress sites where the plugin is active. The CVSS 3.1 score is 7.5 with confidentiality-only impact (C:H/I:N/A:N), and the vector requires no authentication or user interaction. No CISA KEV entry and no public exploit code are identified in the available data; no public exploit identified at time of analysis, and priority is assessed as this_week.
Unauthenticated cross-site scripting in WP Crowdfunding 2.2.2 and earlier lets remote attackers inject script that executes in a victim's browser when the victim is induced to load a crafted request. The flaw is rated CVSS 7.1 (CWE-79) and requires user interaction, so delivery depends on phishing or similar lures; no public exploit was identified at time of analysis, and it is not in CISA KEV. The vuln.today framework assigns this_week priority, and upgrading beyond 2.2.2 is the remediation path.
Privilege escalation in the Kirki plugin for WordPress (all versions up to and including 6.2.5) allows authenticated users with only Subscriber-level access to reach a vulnerable deserialization path in the 'get-single-symbol' branch of the kirki_post_apis() AJAX dispatcher, which lacks a capability check, and to inject a PHP object. Because a POP chain is present in the running code, a successful injection can overwrite an administrator's password and hand the attacker full administrative control of the site. The CVSS vector confirms network reachability, low privileges (PR:L), and no user interaction (UI:N) for a high-integrity, high-availability impact; EPSS is low at 0.30% (23rd percentile) and there is no KEV listing, so there is no public exploit identified at time of analysis, though the practical exposure is governed by whether a site permits open user registration.
PHP Object Injection in the Kirki WordPress plugin through 6.3.2 allows an authenticated Editor-level user to submit serialized data to the template import endpoint, but real impact is conditional on another installed plugin or theme providing a usable POP chain. Kirki itself contains no gadget chain, so the flaw alone does not enable file deletion, data theft, or code execution; the supplied 7.2 score overstates immediate risk, and no public exploit was identified at time of analysis. By default, KIRKI_USERS_DEFAULT_FULL_ACCESS lets Editors reach the endpoint despite the PR:H vector.
Unauthenticated information disclosure in the Kirki - Freeform Page Builder, Website Builder & Customizer plugin for WordPress through 6.3.2 allows remote attackers to read arbitrary users’ profile data by manipulating the 'context' parameter. The flaw is exploitable only when a published page uses a Kirki template containing at least one user-type dynamic content block, but under that condition no authentication or user interaction is needed and user IDs can be enumerated through standard WordPress REST endpoints. Impact is limited to disclosure of string-valued profile and user-meta fields, with no integrity or availability effect; no public exploit code was identified at time of analysis.
Unauthenticated remote attackers can force-publish, rewrite, and create the managed pages of any WordPress site running Tutor LMS below 4.1.1, because the plugin's page-regeneration routine omits a capability check (CWE-862). Impact is confined to integrity - unpublished pages can be pushed live, existing page content overwritten, missing pages created, and the plugin options that reference those pages changed - with no confidentiality or availability effect and no code execution, so realistic damage is content tampering and manipulation of plugin page references rather than site takeover. Publicly available exploit code exists, and the CVSS 3.1 base score is 7.5 (HIGH) with vector AV:N/AC:L/PR:N/UI:N, making it trivially reachable on exposed sites; there is no CISA KEV entry indicating confirmed active exploitation at time of analysis.
Cross-site scripting in Tutor LMS 4.1.0 and earlier allows unauthenticated remote attackers to inject script into pages viewed by victims, but exploitation requires a victim to interact with attacker-supplied content. Successful attacks execute JavaScript in the victim’s browser context with low confidentiality, integrity, and availability impact, potentially enabling session theft or unauthorized actions on behalf of an administrator or instructor. The provided data identifies no public exploit code and no confirmed active exploitation; the Patchstack advisory is the primary reference.
Stored cross-site scripting (XSS) in the Kirki - Freeform Page Builder, Website Builder & Customizer WordPress plugin through version 6.3.1 allows unauthenticated attackers to inject arbitrary web scripts into registration metadata that executes when a user views a page rendering a Kirki users collection with an image element bound to one of nine registration meta fields. Exploitation requires that public user registration is enabled, that a published page contains a `kirki-register` element (which exposes the necessary nonce in public markup), and that an image element is bound to a registration meta field; default installations without open registration are not affected. A vendor patch is available in version 6.3.2, and no public exploit code has been identified at the time of analysis.
Improper input validation in the Themeum Kirki WordPress plugin through version 6.3.1 allows unauthenticated remote attackers to access functionality not properly constrained by ACLs, yielding high confidentiality impact and low integrity impact with no availability impact. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N (base 8.2) confirms network exploitation without privileges or user interaction, so any WordPress site running Kirki from initial release through 6.3.1 is exposed. No public exploit identified at time of analysis, though the Patchstack reference URL labels the issue as arbitrary code execution; the authoritative assessment aligns with CWE-1284 broken access control rather than a confirmed RCE outcome.
Blind SQL injection in Themeum's WP Mega Menu WordPress plugin (versions through 1.4.2) allows an attacker who already holds a high-privilege, administrator-level account to feed crafted input into a vulnerable plugin parameter that is not neutralized before reaching a SQL query, letting them infer database contents one query at a time. Exploitation is privilege-gated (CVSS PR:H) and the injection is blind, so extraction is slow and no anonymous or low-privileged user can reach it; user interaction is not required (UI:N). The CVE carries a CVSS 3.1 base score of 7.6, but the effective risk is lower than that number implies given the authentication prerequisite, and no public exploit code has been identified at time of analysis.
Remote code execution is achievable in Tutor LMS WordPress plugin (≤4.0.7) via a PHP Object Injection flaw in the withdrawal account AJAX handler that exploits a subtle interaction between `esc_sql()` percent-escaping and PHP serialized string-length declarations. Authenticated attackers with subscriber-level access — or unauthenticated attackers on sites with user registration enabled, the typical eLearning configuration — can inject an arbitrary serialized object stream and trigger the well-documented `GuzzleHttp\Cookie\FileCookieJar` POP chain to write a webshell to an attacker-specified path. No public exploit or KEV listing is confirmed at time of analysis, but a fix changeset is available and the POP chain is reliably reachable due to the plugin's bundled PayPal Composer autoloader.
Stored Cross-Site Scripting in the Kirki - Freeform Page Builder, Website Builder & Customizer WordPress plugin (all versions through 6.2.0) allows unauthenticated attackers to permanently embed malicious JavaScript into pages via the unsanitized 'comment' parameter. Injected payloads persist in the database and execute in every subsequent visitor's browser session, enabling session hijacking, credential theft, or privilege escalation against logged-in administrators who view the affected pages. No public exploit or CISA KEV listing has been identified at time of analysis, but the unauthenticated write vector makes mass-exploitation trivially automatable across unpatched WordPress installations.
Unauthenticated cross-site scripting (XSS) in the Kirki WordPress customizer plugin (all versions up to and including 6.2.3) allows remote, unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser when the victim is socially engineered into visiting a crafted URL or page. The CVSS scope change (S:C) indicates injected script execution escapes the plugin's own context, enabling session hijacking, credential theft, or unauthorized admin actions against authenticated WordPress users. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the zero-privilege-required, low-complexity attack path makes this accessible to unsophisticated attackers targeting WordPress sites.
Object injection in the Themeum Kirki WordPress customizer framework (all versions through 6.0.12) allows attackers to abuse PHP deserialization of untrusted data (CWE-502), potentially leading to arbitrary object instantiation and, given a suitable POP gadget chain, remote code execution or full site compromise. Reported by Patchstack with a maximum CVSS 9.8 rating; no public exploit identified at time of analysis and the flaw is not listed in CISA KEV. Because Kirki is a developer toolkit bundled into many premium WordPress themes, exposure depends on which theme/plugin code passes attacker-controllable input into its deserialization path.
Stored cross-site scripting in the Themeum Kirki WordPress customizer framework (versions through 6.0.11) lets an attacker persist malicious script that executes in the browsers of users who later view the affected page or admin screen. Because the CVSS scope is marked changed (S:C), a successful payload can act beyond the vulnerable component's boundary, affecting whoever renders the stored input. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Blind SQL injection in the Themeum Kirki WordPress customizer framework (all versions up to and including 6.0.12) lets remote attackers inject SQL through improperly neutralized special elements, per the CVSS PR:N vector without authentication, to infer and extract database contents. The scope-changed CVSS 3.1 score of 9.3 reflects impact reaching beyond the plugin's own security boundary into the wider WordPress database. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Broken access control in the Themeum Kirki WordPress customizer framework (versions up to and including 6.0.13) allows remote unauthenticated attackers to reach functionality protected by incorrectly configured access-control levels, resulting in disclosure of sensitive information. The flaw was reported by Patchstack and stems from a missing authorization check (CWE-862); no public exploit has been identified at time of analysis. With a CVSS of 7.5 driven purely by confidentiality impact, the practical risk is unauthorized data exposure rather than site takeover.
SQL injection in Tutor LMS Pro (Themeum) versions 3.9.6 and earlier allows remote unauthenticated attackers to inject arbitrary SQL against the underlying WordPress database. The CVSS 9.3 rating reflects a scope change with high confidentiality impact, meaning data accessible to the WordPress backend can be exposed. As of analysis, no public exploit identified at time of analysis, and the issue is tracked via Patchstack.
Unauthenticated local file inclusion in the Themeum Right Way WordPress theme versions 4.0 and earlier allows remote attackers to include arbitrary local files and likely achieve code execution through PHP file inclusion (CWE-98). The flaw is network-reachable without credentials, though CVSS records high attack complexity (AC:H), and no public exploit has been identified at time of analysis. The advisory is sourced from Patchstack's WordPress vulnerability database.
Reflected cross-site scripting in the Skillate WordPress theme versions 1.2.10 and below allows remote unauthenticated attackers to inject arbitrary JavaScript that executes in a victim's browser when they interact with a crafted link. The flaw carries a CVSS 3.1 score of 7.1 with scope change (S:C), reflecting that the injected script runs in the WordPress site context and can pivot against authenticated users including administrators. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Account takeover in the Kirki Freeform Page Builder WordPress plugin (versions 6.0.0 through 6.0.6) allows unauthenticated remote attackers to hijack any registered account, including administrators, by redirecting password reset links to attacker-controlled email addresses. The flaw stems from the plugin honoring an arbitrary email value supplied alongside a valid username in password reset requests, breaking the trust binding between account and recovery destination. No public exploit identified at time of analysis, but the trivial nature of the bug and Wordfence's published advisory make weaponization straightforward.
Arbitrary file read and deletion in the Kirki - Freeform Page Builder plugin for WordPress (versions through 6.0.6) allows unauthenticated remote attackers to read and delete files within the WordPress uploads base directory by abusing the 'downloadZIP' function. The flaw stems from insufficient path validation and a missing capability check, and was reported by Wordfence; no public exploit identified at time of analysis.
Unauthenticated attackers can overwrite billing profile data (name, email, phone, address) for any WordPress user with an incomplete manual order in Tutor LMS plugin versions ≤3.9.7. The pay_incomplete_order() function accepts attacker-controlled order_id parameters without identity verification, writing billing fields directly to the order owner's profile. Exploitation is simplified by predictable Tutor nonce exposure on public pages, enabling targeted profile manipulation via crafted POST requests with enumerated order IDs. No public exploit or active exploitation confirmed at time of analysis.
Authentication bypass in Tutor LMS Pro WordPress plugin (versions through 3.9.4) allows remote attackers to abuse authentication mechanisms via alternate paths, potentially gaining unauthorized administrative access. CVSS 8.1 reflects high attack complexity (AC:H) requiring specific conditions, yet successful exploitation grants complete system compromise (C:H/I:H/A:H). EPSS probability of 0.02% (6th percentile) indicates low observed exploitation activity. No active exploitation confirmed by CISA KEV. SSVC framework classifies this as non-automatable with total technical impact, making it a priority for organizations running this WordPress LMS plugin despite low real-world exploitation signals.
Authenticated low-privilege users can inject script-related HTML into WordPress sites running Themeum Kirki 6.4.0 or earlier, producing a basic XSS condition. The authoritative assessment rates it medium severity with vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N and notes that a second user, typically an administrator, must view the affected page for a stored payload to execute; the specific injection point is not described in the available sources. No public exploit identified at time of analysis, and there is no CISA KEV confirmation.
Stored cross-site scripting in Themeum Tutor LMS through 4.1.2 lets an authenticated low-privilege user, such as an instructor or student able to submit stored content, persist script that executes when another user views the affected page. The plugin does not properly neutralize input during web page generation (CWE-79), and exploitation also requires victim interaction, so sites with open registration or broad Tutor LMS role assignment face greater exposure. The issue is rated CVSS 6.5, and no public exploit was identified at time of analysis.
Insecure direct object reference in the Tutor LMS WordPress plugin (all versions up to and including 4.1.0) allows any authenticated user holding instructor/author-level capability to take over and overwrite courses belonging to other instructors. Because the course-save routine passes attacker-controlled POST data into wp_insert_post() without stripping the 'ID' key, a non-empty ID is interpreted by WordPress as an update to an existing post, letting the attacker change the victim course's title, content and status and reassign its ownership to themselves. Authentication with at least author-level access is required (CVSS PR:L) and there is no unauthenticated path; no public exploit code was identified at time of analysis and the issue is not in CISA KEV, but sites that grant the instructor role to untrusted or numerous users - multi-instructor marketplaces and open registration setups - carry real content-integrity risk, while single-author sites are effectively unexposed.
Stored cross-site scripting in the Tutor LMS - eLearning and Online Course Solution WordPress plugin (all versions up to and including 4.1.0) allows an authenticated attacker with subscriber-level access or above to inject arbitrary JavaScript via the display_name parameter, which is insufficiently sanitized on input and not escaped on output. The payload is only stored and rendered when a Legal Consent record exists for the attacker's account, causing a 'View Logs' button to appear in the Consent Logs column of wp-admin/users.php; an administrator or other privileged user must then open that page for the script to execute, so exploitation is gated on consent logging being enabled and on a privileged user visiting the affected admin screen. Rated CVSS 6.4 (CWE-79), this is a moderate-severity issue with no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, though the Subscriber-level prerequisite is trivially met on sites with open user registration.
DOM-based cross-site scripting in the Tutor LMS eLearning and online course plugin for WordPress (versions up to and including 4.0.8) lets unauthenticated attackers inject arbitrary JavaScript that runs in a victim's browser when the crafted 'redirect_url' parameter is processed by the Topbar component's back-button handler. Because the CVSS vector carries UI:R, the attacker must convince a victim to open a specially crafted URL and trigger the back-button action - the flaw cannot be exploited passively against a server, and no public exploit code has been identified at time of analysis. Scored 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) and assessed as a moderate-severity client-side issue rather than a top-tier priority, it still allows session-scoped script execution and potential redirect or content-injection abuse on any WordPress site running the affected plugin version.
Stored cross-site scripting in the Kirki - Freeform Page Builder, Website Builder & Customizer plugin for WordPress (all versions up to and including 6.2.0) lets an authenticated user who has been granted the administrator-controlled kirki_content_access capability save arbitrary JavaScript through the Page Builder Text Content field, which then executes in the browser of any user who later views the injected page. Exploitation requires that capability grant, which is a non-default, elevated content permission rather than a standard subscriber or author role, and the stored payload only fires on a subsequent victim page view; upgrading to 6.2.1 removes the flaw. No public exploit code, proof-of-concept, or CISA KEV entry has been identified at the time of analysis, and this rates as a moderate, not high-urgency, issue.
Reflected cross-site scripting in the Tutor LMS - eLearning and online course solution WordPress plugin affects all versions up to and including 4.1.0, allowing unauthenticated attackers to inject arbitrary web scripts through the 'tab' parameter. Exploitation requires user interaction (a victim clicking an attacker-supplied link), and the CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N, base 4.7 Medium) reflects real but constrained risk: the payload only reaches the output sink on lesson pages where the nav-items array is empty, which occurs when a lesson has no post content, no attachments, and comments are disabled or the viewer is not logged in. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis.
Arbitrary shortcode execution in the Kirki - Freeform Page Builder, Website Builder & Customizer plugin for WordPress (all versions up to and including 6.3.1) lets any authenticated user with Subscriber-level access or above inject shortcodes by writing them into their own `display_name` profile field, which the plugin splices unfiltered into composed page markup and then passes through `do_shortcode()`. The flaw is exploitable as a remote, network-reachable issue requiring only a low-privileged account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, 5.4), rated moderate by the independent assessment; the key precondition is that a published page must exist containing a Kirki element whose dynamic content is explicitly bound to the `display_name` user field - typically a team or member-directory / users-collection page - and on sites without such a page the vulnerable code path is never reached. Where that binding does exist, the injected shortcode executes in the request of every visitor, including unauthenticated ones, so per-victim interaction is not required; no public exploit code or confirmed active exploitation was identified at time of analysis.
Race condition in the WordPress plugin Tutor LMS (Themeum) affecting versions through 4.1.1 lets an authenticated attacker with low privileges exploit improper synchronization of a shared resource by firing overlapping concurrent requests in order to win a timing window, with the assessed impact limited to integrity (CVSS 5.3, CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N). Because exploitation requires a valid low-privileged account and depends on a non-deterministic concurrency race (AC:H, SSVC Exploitation: none, Automatable: no), successful abuse is probabilistic rather than reliable. There is no public exploit identified at time of analysis and no CISA KEV listing, so this is a genuine but moderate-priority issue for sites exposing Tutor LMS to registered users rather than an emergency.
Blind server-side request forgery in the Kirki - Freeform Page Builder, Website Builder & Customizer plugin for WordPress, affecting all versions up to and including 6.2.0, allows unauthenticated remote attackers to make the WordPress server issue HTTP requests to arbitrary locations by supplying an attacker-controlled URL in the 'kirki_data' parameter. Because the SSRF is blind (no response body is returned to the attacker), exploitation is assessed as high-complexity: the attacker must already know or correctly guess reachable internal hosts or services, so the practical impact is limited to internal service enumeration, state-changing requests against unauthenticated internal endpoints, and access to cloud instance-metadata addresses that the host can reach. There is no public exploit identified at time of analysis and the vulnerability is not confirmed actively exploited (CISA KEV), making this a moderate-risk, not top-priority, issue for most deployments - though it becomes materially more serious on hosts with broad outbound network reachability or attached cloud IAM roles.
Authenticated Instructor-level users on WordPress sites running the Tutor LMS plugin 4.0.7 or earlier can overwrite, re-parent, or delete quiz question and answer rows belonging to other instructors and administrators by abusing broken ownership checks in the tutor_quiz_builder_save AJAX action. The handler validates only the top-level course_id/topic_id and payload['ID'], then passes attacker-supplied nested question_id, answer_id, deleted_question_ids[], and deleted_answer_ids[] values straight into $wpdb->update and DELETE statements, so an Instructor who controls one course can reach rows owned by others. Impact is limited to integrity of quiz content (CVSS 3.1 base 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) and is only meaningful on multi-instructor or multi-tenant course sites; there is no public exploit code identified at time of analysis and no confirmed active exploitation (not in CISA KEV), and the Instructor privilege prerequisite is the main factor bounding realistic risk. A vendor fix is available in Tutor LMS 4.0.8.
Reflected cross-site scripting in the Tutor LMS WordPress plugin (all versions up to and including 4.0.8) lets unauthenticated attackers craft links whose 'search' parameter injects arbitrary JavaScript into the victim's browser when the dashboard or account search flow is rendered. Exploitation requires the victim to click the crafted link (CVSS 3.1 base 6.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), so the payload never self-triggers, and no public exploit code or confirmed active exploitation was identified at time of analysis. Although any site visitor can be targeted, the practical payoff is highest when an authenticated or privileged user such as an instructor, administrator, or student is lured into clicking, because the script then executes inside that user's session context and can act on their behalf within the WordPress site.
Authenticated users holding only subscriber-level access can permanently delete arbitrary WordPress posts - pages, courses, quizzes, and WooCommerce products - on sites running the Tutor LMS plugin through version 4.0.8. The flaw is an authorization bypass: a lesson-deletion handler reaches wp_delete_post( $id, true ) without verifying the caller has capability over the target post, and the multi-stage exploit chain (create an authored attachment via the profile-photo upload flow, create a Tutor topic reparented to that attachment, then invoke the deletion handler) is required to satisfy the plugin's ownership checks. Wordfence reports it, vendor code changesets are referenced, and no public exploit code or confirmed active exploitation was identified at time of analysis; scored 4.3 by the reporter and assessed by our team as AC:H with moderate-to-low real-world risk, since authentication is mandatory and impact is limited to destructive integrity loss rather than code execution or data exfiltration.
Tutor LMS WordPress plugin versions up to 4.0.8 expose arbitrary users' email addresses and Tutor profile phone numbers to any logged-in subscriber-level attacker through an insecure direct object reference in the student_id parameter. This moderate-priority CWE-639 flaw requires only an authenticated account; open registration on LMS/course sites makes that precondition easy to meet, but exploitation is limited to confidentiality of those fields and does not provide credentials, write access, or code execution. No public exploit code or confirmed active exploitation was identified at time of analysis, and our independent assessment rates confidentiality impact as Low under CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.
Stored Cross-Site Scripting in the WP Crowdfunding WordPress plugin (≤2.2.1, by Themeum) allows authenticated subscribers to inject persistent JavaScript via the `first_name` parameter in the plugin's user profile dashboard. When an administrator views the attacker's user profile via the `?show_user_id=` URL parameter, the payload executes in the admin's browser session, enabling cross-privilege script execution from a subscriber-level account to an administrative context. No public exploit code has been identified and the CVE is absent from CISA KEV, though a patch commit exists in the plugin SVN repository.
Second-order SQL injection in the WP Crowdfunding WordPress plugin by Themeum (versions ≤2.2.1) enables authenticated shop managers to exfiltrate arbitrary database contents. The attack is split across two phases: the attacker writes a malicious payload once to the `wpneo_reward` post meta via the WooCommerce REST API, and the unsanitized value is then injected into a live SQL query on every subsequent public page view that renders the campaign rewards sidebar - making the extraction persistent and silent. No public exploit or KEV listing is identified at time of analysis, but the high confidentiality impact (C:H) and persistent execution model elevate practical risk beyond the CVSS 4.9 base score.
Unauthenticated remote PHP function invocation in the Tutor LMS WordPress plugin (all versions up to and including 4.0.5) allows any internet-accessible attacker to call arbitrary zero-argument PHP functions server-side via a missing-authorization AJAX handler combined with extract()-based variable injection into a template scope. The most critical demonstrated impact is persistent subscriber-level account creation through WordPress core's edit_user() function, which reads POST parameters directly, enabling unauthenticated user registration on any affected site. No CISA KEV listing has been identified at time of analysis, but Wordfence's detailed technical disclosure with specific file paths and line numbers substantially lowers the barrier for independent exploit development against the 6.5 CVSS-rated but trivially accessible unauthenticated attack surface.
Insecure Direct Object References in WP Crowdfunding (Themeum) versions prior to 2.2.1 allow authenticated subscriber-level users to access campaign objects, donor records, or financial data they are not authorized to view. The vulnerability, discovered and reported by Patchstack, stems from missing authorization checks on direct object references within the plugin, enabling lateral data exposure across campaigns or users. No public exploit or active exploitation has been identified at time of analysis, and a vendor patch is available.
Authorization bypass in the Kirki Freeform Page Builder, Website Builder & Customizer plugin for WordPress (all versions through 6.1.1) exposes arbitrary user metadata - including email addresses, assigned roles, registration dates, and all user_meta values - to any authenticated user with custom-level access or above. The flaw is rooted in the plugin's frontend collection REST endpoint failing to verify that the requesting user is authorized to retrieve records for the specified target user ID. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, but the low access barrier (any WordPress account qualifies) makes it a realistic risk on sites with open or attacker-controlled user registration.
Directory traversal in the Kirki WordPress plugin (all versions through 6.1.1) allows authenticated attackers with editor-level access to read arbitrary files on the server by exploiting a flawed strpos()-based path validation guard in the plugin's AJAX ExportImport handler. By crafting a 'data' parameter value that embeds the uploads directory path as a substring while appending directory traversal sequences, an attacker can escape the intended upload directory restriction and retrieve sensitive files such as wp-config.php containing database credentials and secret keys. No active exploitation has been confirmed and no CISA KEV listing exists; the CVSS score of 4.9 (Medium) reflects the high privilege requirement, though the confidentiality impact is rated High due to the severity of files that can be exposed as a precursor to full site compromise.
Stored cross-site scripting in Themeum's Kirki Freeform Page Builder plugin (all versions through 6.2.0) allows WordPress users holding Contributor-level access to inject persistent malicious scripts via the post_meta shortcode, which then execute in the browser of any subsequent visitor to the compromised page. The CVSS scope change (S:C) signals that the impact crosses from the contributor's own session boundary into victim sessions, enabling session hijacking, credential exfiltration, or privilege escalation toward site administration. A fix commit is available in the WordPress plugin repository (changeset 3636487), and no public exploit code or CISA KEV listing has been identified at time of analysis.
Zip Slip path traversal in the Kirki WordPress plugin (all versions through 6.0.13) enables authenticated attackers with custom-level access or above to write arbitrary files anywhere on the server, leading to remote code execution. The root cause is the plugin's app installation and update workflows - install_app, update_app, and get_kirki_template_from_zip - which fetch a user-supplied external ZIP URL via an unsanitized app src parameter and extract its contents without validating entry names for path-traversal sequences. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the write-to-RCE escalation path is mechanically straightforward once the authentication bar is cleared.
Administrator-level SQL injection in the Tutor LMS plugin for WordPress versions ≤4.0.1 permits extraction of sensitive database contents via the coupon_code parameter. The vulnerability requires high privileges but low attack complexity, and no public exploitation or exploit code is currently known.
Unauthorized content disclosure in the Kirki - Freeform Page Builder plugin for WordPress (all versions ≤ 6.0.14) allows unauthenticated remote attackers to read the full title, body, and excerpt of any WordPress post by supplying an arbitrary post ID via the unvalidated `context` parameter in the plugin's frontend REST API. Affected content includes drafts, pending posts, privately published posts, password-protected posts, and trashed posts - bypassing all native WordPress visibility controls. No active exploitation confirmed (not in CISA KEV), and no public POC is identified at time of analysis, but the attack requires zero authentication and low complexity per the CVSS vector.
Broken access control in the Qubely WordPress Gutenberg block plugin (versions up to and including 1.8.14) allows unauthenticated remote attackers to bypass authorization checks and perform restricted actions, resulting in limited confidentiality and integrity compromise. The vulnerability stems from missing authorization enforcement (CWE-862) on one or more plugin endpoints exposed to the network. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS vector reflects high attack complexity, tempering real-world risk below what the unauthenticated access vector alone might suggest.
Missing capability checks in the Tutor LMS Elementor Addons WordPress plugin (Themeum) allow any authenticated WordPress user with Subscriber-level access or higher to activate the Tutor LMS and Elementor plugins without administrative authorization. Affected are all versions through 4.0.0, confirmed by Wordfence threat intelligence. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, and real-world impact is constrained by the requirement for a valid WordPress account.
Directory traversal via the unsanitized 'family' parameter in the Kirki plugin for WordPress (all versions up to and including 6.0.13) enables authenticated users holding editor-level access or above to delete arbitrary directories on the server filesystem, risking data loss and site unavailability. Reported by Wordfence, the flaw originates in insufficient path validation within FontService.php and GlobalDataController.php, which process the 'family' parameter without canonicalization or boundary enforcement. No public exploit code exists and no CISA KEV listing is present at time of analysis, but the potential for irreversible filesystem destruction makes this a meaningful risk on any WordPress site granting editor access to untrusted accounts.
Insecure Direct Object Reference (IDOR) in Tutor LMS WordPress plugin allows authenticated low-privilege users to bypass authorization controls by manipulating user-controlled keys, resulting in unauthorized modification of LMS objects such as courses, lessons, or student records. Affected versions span all releases through 3.9.13 by Themeum. No confirmed active exploitation (KEV) or public exploit code has been identified at time of analysis, but the low attack complexity and wide WordPress deployment surface make this a credible integrity risk for any site running an unpatched version.
Unauthenticated IDOR in the Kirki WordPress customizer toolkit (versions <= 6.0.11) allows remote unauthenticated attackers to reference and manipulate object identifiers they do not own, resulting in unauthorized modification of data and limited availability disruption. The vulnerability carries no confidentiality impact per the CVSS vector (C:N), but the combination of network-exploitability with zero authentication requirements (AV:N/AC:L/PR:N/UI:N) makes it trivially accessible to any internet-facing WordPress installation running an affected version. No public exploit code or CISA KEV listing has been identified at the time of analysis.
Authorization bypass in the Kirki Freeform Page Builder plugin for WordPress (all versions through 6.0.11) enables unauthenticated remote attackers to trigger arbitrary HTML-injected emails to any registered user via the site's own mail infrastructure. Because the email is dispatched through the site's authenticated SMTP path, it inherits the domain's SPF and DKIM reputation, substantially increasing phishing credibility. Critically, attackers can embed a genuine, site-generated WordPress password-reset URL for the target account inside an attacker-controlled HTML body, creating a highly convincing credential-harvesting lure. No public exploit or CISA KEV listing is confirmed at time of analysis.
Unauthenticated sensitive information exposure in the Kirki - Freeform Page Builder, Website Builder & Customizer WordPress plugin (versions through 6.0.11) permits any remote attacker to retrieve the full builder metadata and rendered HTML of any kirki_symbol post - including unpublished drafts - by issuing a crafted AJAX request with a sequential WordPress post ID. The root cause is a missing authorization check (CWE-862) in the get_single_symbol AJAX handler registered in includes/Ajax.php, confirmed by Wordfence. No active exploitation is confirmed in CISA KEV, and no EPSS data was provided, but the trivially automatable nature of post ID enumeration against an unauthenticated network endpoint elevates practical risk above the raw CVSS 5.3 score suggests.
Stored Cross-Site Scripting in Tutor LMS (WordPress plugin by Themeum) versions through 3.9.13 allows authenticated attackers holding author-level or higher WordPress roles to inject persistent malicious scripts via the Lesson Attachment Title field. The injected payload is stored in the WordPress database and executes in the browser of any user who subsequently accesses a course page rendering the attachment - achieving a scope change from the plugin's context into the victim's browsing session. No public exploit code or CISA KEV listing has been identified at time of analysis, but the Wordfence disclosure includes direct source-code references to the vulnerable rendering path, lowering the barrier to exploitation.
SQL injection in Tutor LMS (WordPress plugin by Themeum) exposes the underlying database to read-access by any authenticated administrator. The flaw resides in the withdrawal-request management flow - specifically WithdrawModel.php and withdraw_requests.php - where a 'data' parameter is passed to SQL queries without adequate escaping or parameterization. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the data-exposure impact (C:H) is real, and a patched release (3.9.12) is confirmed in the WordPress plugin repository.
Broken access control in Tutor LMS WordPress plugin versions up to and including 3.9.7 permits unauthenticated remote attackers to bypass authorization checks and access or modify restricted LMS resources. The flaw, classified as CWE-862 (Missing Authorization), stems from the plugin failing to enforce appropriate permission checks before executing sensitive operations. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis, though the unauthenticated attack vector and low complexity make this straightforward to exploit opportunistically.
Authorization bypass in the Kirki Freeform Page Builder plugin for WordPress (all versions through 6.0.6) allows authenticated attackers with subscriber-level privileges to enumerate and read all frontend form structures and stored visitor submission data, including contact details and messages submitted through any site form powered by the plugin. The flaw originates in missing authorization checks on an AJAX handler (Ajax.php, line 675), meaning any logged-in user - including the lowest-privilege role WordPress assigns - can exfiltrate sensitive visitor-submitted information without any administrative context. No public exploit or CISA KEV listing has been identified at time of analysis, but the low privilege barrier and network-accessible attack vector make this a realistic data exposure risk for any multi-user or public-registration WordPress site running the affected plugin.
Authenticated instructors in Tutor LMS versions up to 3.9.9 can manipulate course ownership logic via an attacker-controlled GET parameter to perform unauthorized operations on other instructors' courses, including deleting lessons, quizzes, assignments, and student data, or modifying course content and grades. The vulnerability stems from the `get_course_id_by()` function unconditionally trusting user-supplied input instead of validating course ownership, bypassing the plugin's primary authorization gate. No public exploit code or active exploitation has been identified at time of analysis.
Tutor LMS plugin for WordPress versions up to 3.9.8 allow authenticated attackers to manipulate course content structure (detach lessons, move lessons between topics, reorder content) without proper authorization checks when the 'content_parent' parameter is omitted from requests to the tutor_update_course_content_order() function. Although the CVSS score of 5.3 reflects the absence of confidentiality impact, the vulnerability enables course instructors or subscribers to disrupt course integrity across the entire site despite lacking content management permissions, with no public exploit code confirmed but patch available in version 3.9.9.
SQL injection in Tutor LMS plugin for WordPress through version 3.9.8 allows authenticated Admin-level attackers to extract sensitive database information by injecting malicious SQL via the 'date' parameter, which is insufficiently escaped before being interpolated into a SQL fragment passed to $wpdb->prepare(). The vulnerability requires Admin authentication and does not permit data modification or denial of service. CVSS 6.5 reflects confidentiality impact; exploitation is limited to high-privilege authenticated users.
Unauthorized modification of data in Tutor LMS 3.9.7 and earlier allows authenticated attackers with low privileges to exploit missing authorization checks, potentially altering course content or causing limited service disruption. The vulnerability carries a CVSS score of 5.4 but an EPSS score of 0.02% with no known active exploitation or public proof-of
Insecure Direct Object Reference in Tutor LMS WordPress plugin versions up to 3.9.7 allows authenticated Subscriber-level users to manipulate course content structure across any course by exploiting missing authorization checks in the save_course_content_order() method, enabling attackers to detach lessons from topics, reorder course content, and reassign lessons between courses without proper ownership verification.
Tutor LMS plugin for WordPress up to version 3.9.7 allows authenticated subscribers to enroll in private courses due to missing post_status validation in enrollment functions, exposing private course metadata in user dashboards despite WordPress core preventing actual content access. The vulnerability requires subscriber-level authentication but affects confidentiality and integrity, with confirmed patches available in version 3.9.8.
Stored cross-site scripting (XSS) in Themeum Qubely WordPress plugin version 1.8.14 and earlier allows authenticated high-privilege users to inject malicious scripts that execute in the browsers of other site visitors, compromising session integrity and enabling credential theft or malware distribution. The vulnerability requires administrator authentication and user interaction (UI:R), limiting immediate risk, but stored persistence means injected payloads remain active until remediated. EPSS exploitation probability is extremely low at 0.03%, suggesting minimal real-world targeting despite public disclosure.
An authorization bypass vulnerability exists in Themeum Tutor LMS through version 3.9.4 that allows authenticated users to access resources they should not have permission to view through user-controlled keys in the access control mechanism. This Insecure Direct Object Reference (IDOR) vulnerability affects all Tutor LMS installations up to and including version 3.9.4, enabling an attacker with low privileges to read sensitive data by manipulating object identifiers. The vulnerability has a CVSS score of 6.5 reflecting moderate severity with high confidentiality impact, and while no KEV or widespread POC exploitation has been publicly confirmed, the attack requires only network access and valid authentication credentials.
Missing authorization in Droip plugin for WordPress (all versions ≤2.2.6) allows authenticated attackers with Subscriber-level privileges to manipulate content and settings via droip_post_apis() AJAX handler. Exploitable actions include arbitrary post deletion/creation, post duplication, settings modification, and user account manipulation. Requires only low-privilege authenticated access (PR:L) for high-impact compromise of confidentiality, integrity, and availability (CVSS 8.8). No public exploit identified at time of analysis.
Arbitrary file upload in Themeum Droip WordPress plugin (versions up to 2.5.1) permits authenticated attackers with Subscriber-level privileges or higher to upload malicious files without file type validation in the make_google_font_offline() function, enabling remote code execution on the affected server. CVSS 8.8 severity reflects low privilege requirement (PR:L) and complete confidentiality, integrity, and availability impact. No public exploit identified at time of analysis.
The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the download_data action in all versions up to, and including, 2.1.13. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Qubely - Advanced Gutenberg Blocks allows Stored XSS.8.12. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Qubely - Advanced Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ and 'UniqueID' parameter in all versions up to, and including, 1.8.12 due to. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Missing Authorization vulnerability in Themeum WP Crowdfunding wp-crowdfunding allows Exploiting Incorrectly Configured Access Control Security Levels.1.5. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the install_woocommerce_plugin() function action in all versions up to,. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wp-crowdfunding/search block in all versions up to, and including, 2.1.15 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Missing Authorization vulnerability in Themeum Tutor LMS Elementor Addons tutor-lms-elementor-addons.1.5. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via the ‘rating_filter’ parameter in all versions up to, and including, 2.7.6 due to insufficient escaping on the user supplied. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The Tutor LMS plugin for WordPress is vulnerable to bypass to user registration in versions up to, and including, 2.7.6. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the install_etlms_dependency_plugin() function in all. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
Missing Authorization vulnerability in Themeum WP Crowdfunding allows Exploiting Incorrectly Configured Access Control Security Levels.1.10. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in Themeum Tutor LMS allows Exploiting Incorrectly Configured Access Control Security Levels.7.3. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpcf_donate shortcode in all versions up to, and including, 2.1.11 due to insufficient input. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized administrative actions execution due to a missing capability checks on multiple functions like treport_quiz_atttempt_delete and. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unauthenticated path traversal in Themeum's Droip WordPress plugin (versions prior to 2.5.2) lets remote attackers read sensitive files outside the intended directory and trigger availability impact with scope change to the underlying WordPress host. CVSS rates this 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H), and while no public exploit is identified at time of analysis, the EPSS of 1.13% (78th percentile) signals meaningfully elevated exploitation interest relative to the broader CVE population.
Missing Authorization vulnerability in Themeum Droip droip allows Exploiting Incorrectly Configured Access Control Security Levels.5.2. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in Themeum Tutor LMS.7.2. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'course_carousel_skin' attribute within the plugin's Course Carousel widget in all versions up. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS.7.2. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themeum Tutor LMS allows Stored XSS.7.3. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.