Themeum vulnerabilities
Published CVEs affecting Themeum products: 78 record(s), with severity, exploitation and fixes.
Tutor LMS – eLearning and online course solution 29Kirki – Freeform Page Builder, Website Builder & Customizer 16Tutor Lms 10Kirki 9Tutor LMS Pro 4Qubely 4Tutor LMS Elementor Addons 2WP Crowdfunding 2Skillate 1Right Way 1Tutor LMS BunnyNet Integration 1WP Mega Menu 1
CVE-2025-11564
Medium · 5.3
CWE-862 Oct 25, 2025
Tutor LMS – eLearning and online course solution <= 3.8.3 - Missing Authorization to Unauthenticated Payment Status Update
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check while verifying webhook signatures on the "verifyAndCreateOrderData" function
in all versions up to, and including, 3.8.3. This makes it possible for unauthenticated attackers to bypass payment verification and mark orders as paid by submitting forged webhook requests with `payment_type` set to 'recurring'.
CVE-2025-58663
Medium · 4.3
CWE-862 Sep 22, 2025
WordPress Qubely Plugin <= 1.8.14 - Broken Access Control Vulnerability
Missing Authorization vulnerability in Themeum Qubely qubely allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Qubely: from n/a through <= 1.8.14.
CVE-2025-58249
Medium · 4.3
CWE-201 Sep 22, 2025
WordPress Qubely Plugin <= 1.8.14 - Sensitive Data Exposure Vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in Themeum Qubely qubely allows Retrieve Embedded Sensitive Data.This issue affects Qubely: from n/a through <= 1.8.14.