Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Stored XSS.This issue affects Tutor LMS: from n/a through 4.1.2.
Tutor LMS plugin for WordPress versions up to and including 4.1.0 contains an authorization bypass vulnerability via the 'ID' parameter. Authenticated users with author-level access or higher can modify courses created by other instructors by exploiting missing validation on a user-controlled key. This allows overwriting course titles, content, status, and reassigning course ownership.
The Kirki – Freeform Page Builder, Website Builder & Customizer WordPress plugin up to version 6.3.2 is vulnerable to PHP Object Injection via deserialization of untrusted input. This vulnerability allows authenticated users with at least Editor-level privileges to inject PHP objects. Exploitation requires the presence of a gadget chain (POP chain) in another installed plugin or theme, which could lead to arbitrary file deletion, data disclosure, or code execution. Without such a POP chain, the vulnerability has no direct impact.
The Kirki – Freeform Page Builder plugin for WordPress up to version 6.3.2 contains an insecure direct object reference vulnerability via the 'context' parameter. This flaw allows unauthenticated attackers to access sensitive profile data of arbitrary users, including email addresses, display names, registration dates, profile image URLs, and various user meta fields. Exploitation requires a published page using a Kirki template with at least one user-type dynamic content block. User IDs can be enumerated through standard WordPress REST endpoints, making the attack feasible if such templates exist on the site.
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via display_name Parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that a Legal Consent record exists for the attacker's user account, causing the View Logs button to appear in the wp-admin/users.php Consent Logs column.
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via the 'redirect_url' parameter in versions up to, and including, 4.0.8 This is due to insufficient input validation in the Topbar component's back button handler. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in the victim's browser whenever the victim accesses a page that includes the malicious payload.
The Kirki – Freeform Page Builder, Website Builder & Customizer WordPress plugin is affected by a stored cross-site scripting (XSS) vulnerability in all versions up to and including 6.2.0. This vulnerability arises from insufficient input sanitization and output escaping of page builder text content. Authenticated users with the kirki_content_access capability can inject malicious scripts that execute when other users view the affected pages.
Tutor LMS – eLearning and online course solution plugin for WordPress versions up to and including 4.1.0 is vulnerable to reflected Cross-Site Scripting (XSS) via the 'tab' parameter. The vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts. Exploitation requires a specific condition where a lesson page has an empty nav-items array, which can occur naturally under certain content and comment settings. This vulnerability has a medium severity rating with a CVSS score of 4.7.
CVE-2026-42702 is a high-severity reflected Cross-site Scripting (XSS) vulnerability in Themeum Tutor LMS affecting versions from initial release up to 4.1.0. The flaw involves improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts that execute in the context of the victim's browser. This vulnerability can lead to partial confidentiality, integrity, and availability impacts. No official patch or vendor advisory is provided in the data, so patch status is not confirmed.
The Kirki – Freeform Page Builder, Website Builder & Customizer WordPress plugin is vulnerable to arbitrary shortcode execution in all versions up to and including 6.3.1. This occurs because the plugin inserts a user's display_name into page markup without filtering, then processes it with do_shortcode(). Since display_name can be modified by any user on their own account, authenticated users with Subscriber-level access or higher can execute arbitrary shortcodes. If the page displays user collections, the shortcode executes for every visitor, including unauthenticated ones.
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via registration metadata in all versions up to, and including, 6.3.1 This is due to insufficient escaping in `ExceptionalElements::image_element()`, which concatenates a user-meta value straight into an `<img src="…">` attribute. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute whenever a user accesses a page rendering a Kirki users collection whose image element is bound to one of the nine registration meta fields. Requires public user registration to be enabled and a published page carrying a `kirki-register` element, which prints the required element nonce into the public markup.
CVE-2026-103065 is a high severity vulnerability in Themeum Kirki up to version 6.3.1. It involves improper validation of specified quantity in input, leading to access of functionality not properly constrained by access control lists (ACLs). This could allow unauthorized users to access certain features or functions. The vulnerability has a CVSS score of 8.2, indicating a significant impact on confidentiality with limited impact on integrity and no impact on availability.
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 6.2.0 via the 'kirki_data' Parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.0.7 via the tutor_quiz_builder_save AJAX action due to missing validation that nested question_id, answer_id, deleted_question_ids[], and deleted_answer_ids[] values in the submitted payload belong to a quiz/topic/course the requester is authorized to manage. The handler only validates the top-level course_id, topic_id, and (when supplied) payload['ID'], but the nested identifiers are passed straight into $wpdb->update/DELETE statements in QuizBuilder::save_questions(), QuizBuilder::save_question_answers(), and QuizBuilder::handle_delete(). This makes it possible for authenticated attackers, with Instructor-level access and above, to overwrite the content and re-parent arbitrary quiz questions/answers belonging to other instructors or administrators, and to delete arbitrary quiz question and answer rows.
Tutor LMS – eLearning and online course solution plugin for WordPress versions up to 4.0.8 is vulnerable to reflected Cross-Site Scripting (XSS) via the 'search' parameter. This vulnerability allows unauthenticated attackers to inject arbitrary scripts that execute when a user interacts with a crafted link. The issue arises from insufficient input sanitization and output escaping.
Tutor LMS – eLearning and online course solution plugin for WordPress versions up to 4.0.8 contains an authorization bypass vulnerability. Authenticated users with subscriber-level access or higher can delete arbitrary WordPress posts, including pages, courses, quizzes, and WooCommerce products. The vulnerability arises from improper authorization checks before performing deletion actions. Exploitation requires a multi-step process involving profile photo upload and topic creation before deleting targeted posts.
Tutor LMS plugin for WordPress versions up to 4.0.8 contains an authorization bypass vulnerability via the 'student_id' parameter. This flaw allows authenticated users with subscriber-level access or higher to enumerate user IDs and disclose email addresses and phone numbers of arbitrary users, including administrators. The vulnerability arises from missing validation on a user-controlled key, leading to an insecure direct object reference.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum WP Mega Menu allows Blind SQL Injection.
This issue affects WP Mega Menu: from n/a through 1.4.2.
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7 via the `withdraw_method_field` parameter of the `tutor_save_withdraw_account` AJAX handler. This is due to the handler lacking any capability or role check, relying solely on a nonce, while also passing attacker-supplied values through `esc_sql()`, which replaces every `%` character with a 66-byte HMAC placeholder token before the data is serialized and stored via `update_user_meta()`; when the meta is later retrieved, the placeholder is collapsed back to a single `%`, leaving serialized string length declarations 65 bytes greater than the actual content, and because array keys originate from entirely unescaped POST field names, `unserialize()` over-reads into attacker-controlled bytes, allowing injection of an arbitrary serialized object stream. This makes it possible for authenticated attackers, with subscriber-level access and above, to achieve remote code execution on the server by triggering the `GuzzleHttp\Cookie\FileCookieJar` POP chain, reachable via the `spl_autoload_register` loader in `TUTOR\RestAPI` which loads the plugin's own bundled PayPal Composer autoloader, writing attacker-controlled content to an attacker-specified filename. This has an unauthenticated pathway when user registration is enabled, which is common for students and teachers to register, and it requires the monetization feature to be enabled.