The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.11. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to send arbitrary HTML-injected emails — including phishing messages embedding a real, valid WordPress password-reset URL for the targeted user — to any registered user via the site's own mail server, abusing its SPF/DKIM reputation. The attacker-controlled emailSubject parameter is passed to wp_mail() with only sanitize_text_field() applied, while emailBody 'text' items are concatenated raw into the HTML email body with no escaping, and 'chip' items can include the genuine WordPress password-reset link for the targeted account.
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.11 via the get_single_symbol. This makes it possible for unauthenticated attackers to extract the full builder metadata and rendered HTML of any kirki_symbol post — including unpublished drafts — by supplying a sequential WordPress post ID.
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Lesson Attachment Title in all versions up to, and including, 3.9.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the 'data' parameter in all versions up to, and including, 3.9.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVE-2026-22332 is a critical unauthenticated SQL Injection vulnerability affecting Tutor LMS Pro versions up to and including 3.9.6. This flaw allows an attacker to inject malicious SQL commands without authentication, potentially leading to high confidentiality impact and limited availability impact. No official patch or remediation guidance is currently provided by the vendor. Users of affected versions should monitor vendor advisories for updates and apply patches once available.
CVE-2026-22330 is a high severity vulnerability in Themeum's Right Way product, affecting versions up to and including 4.0. It is an unauthenticated Local File Inclusion (LFI) vulnerability caused by improper control of filenames used in include/require statements in PHP. This flaw allows an attacker to include local files remotely, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.
CVE-2026-22329 is a high-severity vulnerability in Themeum Skillate versions up to and including 1.2.10. It is an unauthenticated Cross-Site Scripting (XSS) flaw that allows improper neutralization of input during web page generation. This vulnerability can lead to partial confidentiality, integrity, and availability impacts. No official patch or remediation guidance is currently provided by the vendor.
The Kirki – Freeform Page Builder, Website Builder & Customizer WordPress plugin versions 6.0.0 through 6.0.6 contain a critical privilege escalation vulnerability. This flaw allows unauthenticated attackers to request password reset links for any registered user by submitting an arbitrary email address alongside a username. Consequently, attackers can take over accounts by receiving password reset links sent to their own email addresses.
The Kirki – Freeform Page Builder, Website Builder & Customizer WordPress plugin up to version 6.0.6 contains a relative path traversal vulnerability in its 'downloadZIP' function. This flaw allows unauthenticated attackers to read and delete arbitrary files within the WordPress uploads base directory due to insufficient file path validation and missing capability checks. The vulnerability is tracked as CVE-2026-8073 and has a high severity rating with a CVSS score of 7.5. There is no confirmed patch or official remediation available at this time.
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to view all Kirki frontend forms and read stored visitor form submission data, including contact details, messages, and any other visitor-provided information submitted through site forms.
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 3.9.9. This is due to the `get_course_id_by()` function unconditionally trusting the user-supplied `course` GET parameter as the authoritative course ID for content ownership lookups, which is then consumed by `can_user_manage()`, the plugin's sole authorization gate for instructor-level operations, causing it to evaluate instructor membership against the attacker-controlled course rather than the course that actually owns the target content object. This makes it possible for authenticated attackers, with instructor-level access and above, to perform unauthorized operations on any other instructor's course content, including permanently deleting lessons, assignments, quizzes (with cascading deletion of all student attempt data), topics, announcements, and Q&A threads, as well as creating or modifying lessons, topics, and announcements in victim courses, manipulating student quiz grades, and reading unpublished lesson and quiz content.
CVE-2026-5502 is a medium severity vulnerability in the Tutor LMS WordPress plugin up to version 3.9.8. It involves a missing authorization check in the tutor_update_course_content_order() function, allowing authenticated users with subscriber-level access or higher to manipulate course content order without proper permission validation. This can disrupt course structure by detaching lessons from topics, moving lessons between topics, and modifying menu order. The vulnerability arises because the function only validates a nonce but skips user permission checks when a specific parameter is omitted.
The Tutor LMS plugin for WordPress is vulnerable to SQL Injection in versions up to and including 3.9.8. This is due to insufficient escaping on the 'date' parameter combined with direct interpolation into a SQL fragment before being passed to $wpdb->prepare(). This makes it possible for authenticated attackers with Admin-level access and above to append additional SQL queries and extract sensitive information from the database.
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.9.7. This is due to missing authorization checks in the `save_course_content_order()` private method, which is called unconditionally by the `tutor_update_course_content_order` AJAX handler. While the handler's `content_parent` branch includes a `can_user_manage()` check, the `save_course_content_order()` call processes attacker-supplied `tutor_topics_lessons_sorting` JSON without any ownership or capability verification. This makes it possible for authenticated attackers with Subscriber-level access or above to detach lessons from topics, reorder course content, and reassign lessons between topics in any course, including admin-owned courses, by sending a crafted AJAX request with manipulated topic and lesson IDs.