Themeum

CVE	Summary	Severity	CVSS	EPSS	Priority	Signals
CVE-2026-57724	Object injection in the Themeum Kirki WordPress customizer framework (all versions through 6.0.12) allows attackers to abuse PHP deserialization of untrusted data (CWE-502), potentially leading to arbitrary object instantiation and, given a suitable POP gadget chain, remote code execution or full site compromise. Reported by Patchstack with a maximum CVSS 9.8 rating; no public exploit identified at time of analysis and the flaw is not listed in CISA KEV. Because Kirki is a developer toolkit bundled into many premium WordPress themes, exposure depends on which theme/plugin code passes attacker-controllable input into its deserialization path.	CRITICAL	9.8	0.6%	49	No patch
CVE-2026-57726	Blind SQL injection in the Themeum Kirki WordPress customizer framework (all versions up to and including 6.0.12) lets remote attackers inject SQL through improperly neutralized special elements, per the CVSS PR:N vector without authentication, to infer and extract database contents. The scope-changed CVSS 3.1 score of 9.3 reflects impact reaching beyond the plugin's own security boundary into the wider WordPress database. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.	CRITICAL	9.3	0.4%	46	No patch
CVE-2026-78175	Remote code execution is achievable in Tutor LMS WordPress plugin (≤4.0.7) via a PHP Object Injection flaw in the withdrawal account AJAX handler that exploits a subtle interaction between `esc_sql()` percent-escaping and PHP serialized string-length declarations. Authenticated attackers with subscriber-level access — or unauthenticated attackers on sites with user registration enabled, the typical eLearning configuration — can inject an arbitrary serialized object stream and trigger the well-documented `GuzzleHttp\Cookie\FileCookieJar` POP chain to write a webshell to an attacker-specified path. No public exploit or KEV listing is confirmed at time of analysis, but a fix changeset is available and the POP chain is reliably reachable due to the plugin's bundled PayPal Composer autoloader.	HIGH	8.8	0.6%	45	No patch
CVE-2026-57727	Broken access control in the Themeum Kirki WordPress customizer framework (versions up to and including 6.0.13) allows remote unauthenticated attackers to reach functionality protected by incorrectly configured access-control levels, resulting in disclosure of sensitive information. The flaw was reported by Patchstack and stems from a missing authorization check (CWE-862); no public exploit has been identified at time of analysis. With a CVSS of 7.5 driven purely by confidentiality impact, the practical risk is unauthorized data exposure rather than site takeover.	HIGH	7.5	0.4%	38	No patch
CVE-2026-17037	Stored Cross-Site Scripting in the Kirki - Freeform Page Builder, Website Builder & Customizer WordPress plugin (all versions through 6.2.0) allows unauthenticated attackers to permanently embed malicious JavaScript into pages via the unsanitized 'comment' parameter. Injected payloads persist in the database and execute in every subsequent visitor's browser session, enabling session hijacking, credential theft, or privilege escalation against logged-in administrators who view the affected pages. No public exploit or CISA KEV listing has been identified at time of analysis, but the unauthenticated write vector makes mass-exploitation trivially automatable across unpatched WordPress installations.	HIGH	7.2	0.3%	36	No patch
CVE-2026-66629	Unauthenticated cross-site scripting (XSS) in the Kirki WordPress customizer plugin (all versions up to and including 6.2.3) allows remote, unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser when the victim is socially engineered into visiting a crafted URL or page. The CVSS scope change (S:C) indicates injected script execution escapes the plugin's own context, enabling session hijacking, credential theft, or unauthorized admin actions against authenticated WordPress users. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the zero-privilege-required, low-complexity attack path makes this accessible to unsophisticated attackers targeting WordPress sites.	HIGH	7.1	0.2%	36	No patch
CVE-2026-57725	Stored cross-site scripting in the Themeum Kirki WordPress customizer framework (versions through 6.0.11) lets an attacker persist malicious script that executes in the browsers of users who later view the affected page or admin screen. Because the CVSS scope is marked changed (S:C), a successful payload can act beyond the vulnerable component's boundary, affecting whoever renders the stored input. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.	HIGH	7.1	0.3%	36	No patch
CVE-2026-65436	We need to produce a JSON object with specified fields. Let's gather the data: CVE-2026-65436, description: Editor Arbitrary File Deletion in Kirki <= 6.0.13 versions. No KEV mentioned, so not actively exploited. No EPSS data provided (must state missing). No POC info. CVSS: 6.8, vector: AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H. CWE-22 Path Traversal. Multi-source: Patchstack reported, CPE: cpe:2.3:a:themeum:kirki::::::::, Tags: Path Traversal, Kirki. EUVD ID, affected versions: n/a ≤6.0.13. References: Patchstack advisory. Now, product name: "Kirki" (WordPress plugin). So product_name: "Kirki". Summary: Need to synthesize original. Not copy description. Start with impact verb, product. Remote arbitrary file deletion in Kirki WordPress plugin up to 6.0.13, requiring high privileges (editor role). Attackers can delete arbitrary files on the server, causing availability impact (file loss). No evidence of active exploitation or public exploit. EPSS not provided. Technical context: Underlying technology: WordPress plugin for customizing themes. CWE-22 path traversal means improper limitation of a pathname to a restricted directory. Likely insufficient sanitization of user input that gets passed to file deletion functions. The affected product is Kirki plugin by Themeum (cpe:2.3:a:themeum:kirki:* up to 6.0.13). Root cause: path traversal in file deletion functionality accessible to high-privilege users (editor role). CVSS shows network vector, low complexity, high privileges, no user interaction, changed scope, confidentiality none, integrity none, availability high. Risk assessment: CVSS 6.8 medium, but scope changed? Actually 6.8 is medium, but vector includes S:C, and availability impact high, so affecting another component? The vector says scope changed (S:C), meaning the vulnerable component's scope changes, and the impact is on a subsequent component (C:N/I:N/A:H). But that's odd for file deletion within the same system. Possibly the plugin's file deletion i	MEDIUM	6.8	0.3%	34	No patch
CVE-2026-16759	Unauthenticated remote PHP function invocation in the Tutor LMS WordPress plugin (all versions up to and including 4.0.5) allows any internet-accessible attacker to call arbitrary zero-argument PHP functions server-side via a missing-authorization AJAX handler combined with extract()-based variable injection into a template scope. The most critical demonstrated impact is persistent subscriber-level account creation through WordPress core's edit_user() function, which reads POST parameters directly, enabling unauthenticated user registration on any affected site. No CISA KEV listing has been identified at time of analysis, but Wordfence's detailed technical disclosure with specific file paths and line numbers substantially lowers the barrier for independent exploit development against the 6.5 CVSS-rated but trivially accessible unauthenticated attack surface.	MEDIUM	6.5	0.4%	33	No patch
CVE-2026-15022	We need to produce a JSON object with specific fields. Let's analyze the CVE data. First: product_name: "1-3 words ONLY. The specific product or service name affected." The CPE: cpe:2.3:a:themeum:tutor_lms_–_elearning_and_online_course_solution. The description says "Tutor LMS - eLearning and online course solution plugin for WordPress". So product name is "Tutor LMS" or "Tutor LMS for WordPress". The product_name field should be concise: "Tutor LMS" is probably enough. But it says "1-3 words". So "Tutor LMS" works. summary: Must be original synthesis. Don't copy description. Need to incorporate all data: KEV? Not mentioned, so not actively exploited. EPSS 0.34% -> low probability. POC? Not mentioned, so presumably no. SSVC: exploitation none, automatable no. So risk is low. But SQL injection, second-order stored. The vulnerability allows authenticated attackers with custom-level access to inject SQL in stored quiz answers, executed later via REST API endpoint by privileged users or API key holders, leading to sensitive data exposure. Impact: CVSS 6.5, confidentiality high, no integrity/availability. So summary: something like: "Stored second-order SQL injection in Tutor LMS for WordPress allows authenticated attackers with custom-level access to extract sensitive database information by injecting SQL payloads into quiz answers. The payload is stored via the quiz abandonment AJAX handler and later executed when a privileged user or API key holder requests quiz attempt details via REST API." Add EPSS, no active exploitation. Mention that the vulnerability is in all versions up to 4.0.0. technical_context: Underlying technology: WordPress plugin, PHP, SQL. CWE-89 SQL Injection. Use CPE to identify exact products: Tutor LMS plugin. The root cause: insufficient escaping and lack of prepared statements in SQL query building, specifically in the REST_Quiz.php and Quiz.php files when handling quiz answer arrays. The injection is stored at quiz attempt time and executed	MEDIUM	6.5	0.3%	33	No patch
CVE-2026-73189	Insecure Direct Object References in WP Crowdfunding (Themeum) versions prior to 2.2.1 allow authenticated subscriber-level users to access campaign objects, donor records, or financial data they are not authorized to view. The vulnerability, discovered and reported by Patchstack, stems from missing authorization checks on direct object references within the plugin, enabling lateral data exposure across campaigns or users. No public exploit or active exploitation has been identified at time of analysis, and a vendor patch is available.	MEDIUM	6.5	0.3%	33
CVE-2026-57680	Unauthenticated IDOR in the Kirki WordPress customizer toolkit (versions <= 6.0.11) allows remote unauthenticated attackers to reference and manipulate object identifiers they do not own, resulting in unauthorized modification of data and limited availability disruption. The vulnerability carries no confidentiality impact per the CVSS vector (C:N), but the combination of network-exploitability with zero authentication requirements (AV:N/AC:L/PR:N/UI:N) makes it trivially accessible to any internet-facing WordPress installation running an affected version. No public exploit code or CISA KEV listing has been identified at the time of analysis.	MEDIUM	6.5	0.3%	32	No patch
CVE-2026-57694	Insecure Direct Object Reference (IDOR) in Tutor LMS WordPress plugin allows authenticated low-privilege users to bypass authorization controls by manipulating user-controlled keys, resulting in unauthorized modification of LMS objects such as courses, lessons, or student records. Affected versions span all releases through 3.9.13 by Themeum. No confirmed active exploitation (KEV) or public exploit code has been identified at time of analysis, but the low attack complexity and wide WordPress deployment surface make this a credible integrity risk for any site running an unpatched version.	MEDIUM	6.5	0.3%	32	No patch
CVE-2026-19945	Stored Cross-Site Scripting in the WP Crowdfunding WordPress plugin (≤2.2.1, by Themeum) allows authenticated subscribers to inject persistent JavaScript via the `first_name` parameter in the plugin's user profile dashboard. When an administrator views the attacker's user profile via the `?show_user_id=` URL parameter, the payload executes in the admin's browser session, enabling cross-privilege script execution from a subscriber-level account to an administrative context. No public exploit code has been identified and the CVE is absent from CISA KEV, though a patch commit exists in the plugin SVN repository.	MEDIUM	6.4	0.2%	32	No patch
CVE-2026-13443	Stored Cross-Site Scripting in Tutor LMS (WordPress plugin by Themeum) versions through 3.9.13 allows authenticated attackers holding author-level or higher WordPress roles to inject persistent malicious scripts via the Lesson Attachment Title field. The injected payload is stored in the WordPress database and executes in the browser of any user who subsequently accesses a course page rendering the attachment - achieving a scope change from the plugin's context into the victim's browsing session. No public exploit code or CISA KEV listing has been identified at time of analysis, but the Wordfence disclosure includes direct source-code references to the vulnerable rendering path, lowering the barrier to exploitation.	MEDIUM	6.4	0.2%	32	No patch

CVE-2026-57724

Object injection in the Themeum Kirki WordPress customizer framework (all versions through 6.0.12) allows attackers to abuse PHP deserialization of untrusted data (CWE-502), potentially leading to arbitrary object instantiation and, given a suitable POP gadget chain, remote code execution or full site compromise. Reported by Patchstack with a maximum CVSS 9.8 rating; no public exploit identified at time of analysis and the flaw is not listed in CISA KEV. Because Kirki is a developer toolkit bundled into many premium WordPress themes, exposure depends on which theme/plugin code passes attacker-controllable input into its deserialization path.

CRITICAL

9.8

0.6%

49

No patch

CVE-2026-57726

Blind SQL injection in the Themeum Kirki WordPress customizer framework (all versions up to and including 6.0.12) lets remote attackers inject SQL through improperly neutralized special elements, per the CVSS PR:N vector without authentication, to infer and extract database contents. The scope-changed CVSS 3.1 score of 9.3 reflects impact reaching beyond the plugin's own security boundary into the wider WordPress database. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.

CRITICAL

9.3

0.4%

46

No patch

CVE-2026-78175

Remote code execution is achievable in Tutor LMS WordPress plugin (≤4.0.7) via a PHP Object Injection flaw in the withdrawal account AJAX handler that exploits a subtle interaction between `esc_sql()` percent-escaping and PHP serialized string-length declarations. Authenticated attackers with subscriber-level access — or unauthenticated attackers on sites with user registration enabled, the typical eLearning configuration — can inject an arbitrary serialized object stream and trigger the well-documented `GuzzleHttp\Cookie\FileCookieJar` POP chain to write a webshell to an attacker-specified path. No public exploit or KEV listing is confirmed at time of analysis, but a fix changeset is available and the POP chain is reliably reachable due to the plugin's bundled PayPal Composer autoloader.

HIGH

8.8

0.6%

45

No patch

CVE-2026-57727

Broken access control in the Themeum Kirki WordPress customizer framework (versions up to and including 6.0.13) allows remote unauthenticated attackers to reach functionality protected by incorrectly configured access-control levels, resulting in disclosure of sensitive information. The flaw was reported by Patchstack and stems from a missing authorization check (CWE-862); no public exploit has been identified at time of analysis. With a CVSS of 7.5 driven purely by confidentiality impact, the practical risk is unauthorized data exposure rather than site takeover.

HIGH

7.5

0.4%

38

No patch

CVE-2026-17037

Stored Cross-Site Scripting in the Kirki - Freeform Page Builder, Website Builder & Customizer WordPress plugin (all versions through 6.2.0) allows unauthenticated attackers to permanently embed malicious JavaScript into pages via the unsanitized 'comment' parameter. Injected payloads persist in the database and execute in every subsequent visitor's browser session, enabling session hijacking, credential theft, or privilege escalation against logged-in administrators who view the affected pages. No public exploit or CISA KEV listing has been identified at time of analysis, but the unauthenticated write vector makes mass-exploitation trivially automatable across unpatched WordPress installations.

HIGH

7.2

0.3%

36

No patch

CVE-2026-66629

Unauthenticated cross-site scripting (XSS) in the Kirki WordPress customizer plugin (all versions up to and including 6.2.3) allows remote, unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser when the victim is socially engineered into visiting a crafted URL or page. The CVSS scope change (S:C) indicates injected script execution escapes the plugin's own context, enabling session hijacking, credential theft, or unauthorized admin actions against authenticated WordPress users. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the zero-privilege-required, low-complexity attack path makes this accessible to unsophisticated attackers targeting WordPress sites.

HIGH

7.1

0.2%

36

No patch

CVE-2026-57725

Stored cross-site scripting in the Themeum Kirki WordPress customizer framework (versions through 6.0.11) lets an attacker persist malicious script that executes in the browsers of users who later view the affected page or admin screen. Because the CVSS scope is marked changed (S:C), a successful payload can act beyond the vulnerable component's boundary, affecting whoever renders the stored input. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

HIGH

7.1

0.3%

36

No patch

CVE-2026-65436

We need to produce a JSON object with specified fields. Let's gather the data: CVE-2026-65436, description: Editor Arbitrary File Deletion in Kirki <= 6.0.13 versions. No KEV mentioned, so not actively exploited. No EPSS data provided (must state missing). No POC info. CVSS: 6.8, vector: AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H. CWE-22 Path Traversal. Multi-source: Patchstack reported, CPE: cpe:2.3:a:themeum:kirki:*:*:*:*:*:*:*:*, Tags: Path Traversal, Kirki. EUVD ID, affected versions: n/a ≤6.0.13. References: Patchstack advisory. Now, product name: "Kirki" (WordPress plugin). So product_name: "Kirki". Summary: Need to synthesize original. Not copy description. Start with impact verb, product. Remote arbitrary file deletion in Kirki WordPress plugin up to 6.0.13, requiring high privileges (editor role). Attackers can delete arbitrary files on the server, causing availability impact (file loss). No evidence of active exploitation or public exploit. EPSS not provided. Technical context: Underlying technology: WordPress plugin for customizing themes. CWE-22 path traversal means improper limitation of a pathname to a restricted directory. Likely insufficient sanitization of user input that gets passed to file deletion functions. The affected product is Kirki plugin by Themeum (cpe:2.3:a:themeum:kirki:* up to 6.0.13). Root cause: path traversal in file deletion functionality accessible to high-privilege users (editor role). CVSS shows network vector, low complexity, high privileges, no user interaction, changed scope, confidentiality none, integrity none, availability high. Risk assessment: CVSS 6.8 medium, but scope changed? Actually 6.8 is medium, but vector includes S:C, and availability impact high, so affecting another component? The vector says scope changed (S:C), meaning the vulnerable component's scope changes, and the impact is on a subsequent component (C:N/I:N/A:H). But that's odd for file deletion within the same system. Possibly the plugin's file deletion i

MEDIUM

6.8

0.3%

34

No patch

CVE-2026-16759

Unauthenticated remote PHP function invocation in the Tutor LMS WordPress plugin (all versions up to and including 4.0.5) allows any internet-accessible attacker to call arbitrary zero-argument PHP functions server-side via a missing-authorization AJAX handler combined with extract()-based variable injection into a template scope. The most critical demonstrated impact is persistent subscriber-level account creation through WordPress core's edit_user() function, which reads POST parameters directly, enabling unauthenticated user registration on any affected site. No CISA KEV listing has been identified at time of analysis, but Wordfence's detailed technical disclosure with specific file paths and line numbers substantially lowers the barrier for independent exploit development against the 6.5 CVSS-rated but trivially accessible unauthenticated attack surface.

MEDIUM

6.5

0.4%

33

No patch

CVE-2026-15022

We need to produce a JSON object with specific fields. Let's analyze the CVE data. First: product_name: "1-3 words ONLY. The specific product or service name affected." The CPE: cpe:2.3:a:themeum:tutor_lms_–_elearning_and_online_course_solution. The description says "Tutor LMS - eLearning and online course solution plugin for WordPress". So product name is "Tutor LMS" or "Tutor LMS for WordPress". The product_name field should be concise: "Tutor LMS" is probably enough. But it says "1-3 words". So "Tutor LMS" works. summary: Must be original synthesis. Don't copy description. Need to incorporate all data: KEV? Not mentioned, so not actively exploited. EPSS 0.34% -> low probability. POC? Not mentioned, so presumably no. SSVC: exploitation none, automatable no. So risk is low. But SQL injection, second-order stored. The vulnerability allows authenticated attackers with custom-level access to inject SQL in stored quiz answers, executed later via REST API endpoint by privileged users or API key holders, leading to sensitive data exposure. Impact: CVSS 6.5, confidentiality high, no integrity/availability. So summary: something like: "Stored second-order SQL injection in Tutor LMS for WordPress allows authenticated attackers with custom-level access to extract sensitive database information by injecting SQL payloads into quiz answers. The payload is stored via the quiz abandonment AJAX handler and later executed when a privileged user or API key holder requests quiz attempt details via REST API." Add EPSS, no active exploitation. Mention that the vulnerability is in all versions up to 4.0.0. technical_context: Underlying technology: WordPress plugin, PHP, SQL. CWE-89 SQL Injection. Use CPE to identify exact products: Tutor LMS plugin. The root cause: insufficient escaping and lack of prepared statements in SQL query building, specifically in the REST_Quiz.php and Quiz.php files when handling quiz answer arrays. The injection is stored at quiz attempt time and executed

MEDIUM

6.5

0.3%

33

No patch

CVE-2026-73189

Insecure Direct Object References in WP Crowdfunding (Themeum) versions prior to 2.2.1 allow authenticated subscriber-level users to access campaign objects, donor records, or financial data they are not authorized to view. The vulnerability, discovered and reported by Patchstack, stems from missing authorization checks on direct object references within the plugin, enabling lateral data exposure across campaigns or users. No public exploit or active exploitation has been identified at time of analysis, and a vendor patch is available.

MEDIUM

6.5

0.3%

33

CVE-2026-57680

Unauthenticated IDOR in the Kirki WordPress customizer toolkit (versions <= 6.0.11) allows remote unauthenticated attackers to reference and manipulate object identifiers they do not own, resulting in unauthorized modification of data and limited availability disruption. The vulnerability carries no confidentiality impact per the CVSS vector (C:N), but the combination of network-exploitability with zero authentication requirements (AV:N/AC:L/PR:N/UI:N) makes it trivially accessible to any internet-facing WordPress installation running an affected version. No public exploit code or CISA KEV listing has been identified at the time of analysis.

MEDIUM

6.5

0.3%

32

No patch

CVE-2026-57694

Insecure Direct Object Reference (IDOR) in Tutor LMS WordPress plugin allows authenticated low-privilege users to bypass authorization controls by manipulating user-controlled keys, resulting in unauthorized modification of LMS objects such as courses, lessons, or student records. Affected versions span all releases through 3.9.13 by Themeum. No confirmed active exploitation (KEV) or public exploit code has been identified at time of analysis, but the low attack complexity and wide WordPress deployment surface make this a credible integrity risk for any site running an unpatched version.

MEDIUM

6.5

0.3%

32

No patch

CVE-2026-19945

Stored Cross-Site Scripting in the WP Crowdfunding WordPress plugin (≤2.2.1, by Themeum) allows authenticated subscribers to inject persistent JavaScript via the `first_name` parameter in the plugin's user profile dashboard. When an administrator views the attacker's user profile via the `?show_user_id=` URL parameter, the payload executes in the admin's browser session, enabling cross-privilege script execution from a subscriber-level account to an administrative context. No public exploit code has been identified and the CVE is absent from CISA KEV, though a patch commit exists in the plugin SVN repository.

MEDIUM

6.4

0.2%

32

No patch

CVE-2026-13443

Stored Cross-Site Scripting in Tutor LMS (WordPress plugin by Themeum) versions through 3.9.13 allows authenticated attackers holding author-level or higher WordPress roles to inject persistent malicious scripts via the Lesson Attachment Title field. The injected payload is stored in the WordPress database and executes in the browser of any user who subsequently accesses a course page rendering the attachment - achieving a scope change from the plugin's context into the victim's browsing session. No public exploit code or CISA KEV listing has been identified at time of analysis, but the Wordfence disclosure includes direct source-code references to the vulnerable rendering path, lowering the barrier to exploitation.

MEDIUM

6.4

0.2%

32

No patch

Severity Breakdown

Monthly CVE Trend

Affected Products (16)

Top Risky CVEs