Themeum develops a focused line of WordPress plugins and learning-management extensions including Tutor LMS, WP Crowdfunding, Qubely, and Droip, serving educational and community-oriented sites within the WordPress ecosystem. The vendor's vulnerability profile concentrates on web-application input-handling and authorization weaknesses, with recurring issues including cross-site scripting, SQL injection, cross-site request forgery, and path-traversal flaws that are characteristic of server-side WordPress plugin development. A moderate share of the vendor's disclosures acquire public exploit code, reflecting the visibility and accessibility of WordPress plugin codebases to security researchers. Defenders should prioritize keeping these plugins updated, as they often run on internet-facing educational and commerce sites where input validation and authentication weaknesses carry operational risk. Live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Themeum over time
Signals from CVEs in this vendor scope (95 CVEs).
95 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-10400HIGH The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via the ‘rating_filter’ parameter in all versions up to, and including, 2.7.6 due to insufficient escaping on the | Nov 21, 2024 | 7.5 | 77 | NO | YES |
CVE-2020-8615MEDIUM A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and performing other malicious actions (such | Feb 4, 2020 | 6.5 | 42 | NO | YES |
CVE-2024-1751HIGH The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the question_id parameter in all versions up to, and includi | Mar 13, 2024 | 8.8 | 36 | NO | YES |
CVE-2021-24916HIGH The Qubely WordPress plugin before 1.8.6 allows unauthenticated user to send arbitrary e-mails to arbitrary addresses via the qubely_send_form_data AJAX action. | Aug 7, 2023 | 7.5 | 32 | NO | YES |
CVE-2025-47555HIGH Authorization Bypass Through User-Controlled Key vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects | Jan 22, 2026 | 8.1 | 29 | NO | NO |
CVE-2025-5835HIGH The Droip plugin for WordPress is vulnerable to unauthorized modification and access of data due to a missing capability check on the droip_post_apis() function in all versions up | Jul 25, 2025 | 8.8 | 29 | NO | NO |
CVE-2025-5831HIGH The Droip plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the make_google_font_offline() function in all versions up to, and exc | Jul 25, 2025 | 8.8 | 29 | NO | NO |
CVE-2023-0236MEDIUM The Tutor LMS WordPress plugin before 2.0.10 does not sanitise and escape the reset_key and user_id parameters before outputting then back in attributes, leading to Reflected Cross | Feb 6, 2023 | 6.1 | 29 | NO | YES |
CVE-2024-4223CRITICAL The Tutor LMS plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on multiple functions in all v | May 16, 2024 | 9.8 | 28 | NO | NO |
CVE-2021-24184HIGH Several AJAX endpoints in the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 were unprotected, allowing students to modify course information and el | Apr 5, 2021 | 8.8 | 28 | NO | NO |
Signals from CVEs in this vendor scope (95 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Themeum.
Media articles that mention a CVE ID that affects a product developed by Themeum — matched by CVE ID, not by vendor name.