themeum Vulnerabilities and Affected Products
Vulnerabilities associated with WP Crowdfunding.
Products
Clear product- Tutor LMS – eLearning and online course solution37 vulnerabilities
- Tutor LMS19 vulnerabilities
- tutor_lms16 vulnerabilities
- Kirki – Freeform Page Builder, Website Builder & Customizer9 vulnerabilities
- Tutor LMS Pro9 vulnerabilities
- WP Crowdfunding9 vulnerabilities
- Kirki7 vulnerabilities
- Tutor LMS Elementor Addons6 vulnerabilities
- Qubely5 vulnerabilities
- Droip2 vulnerabilities
- Qubely – Advanced Gutenberg Blocks2 vulnerabilities
- Tutor LMS – Migration Tool2 vulnerabilities
- Right Way1 vulnerability
- Skillate1 vulnerability
- Tutor LMS BunnyNet Integration1 vulnerability
- tutor_lms_pro1 vulnerability
- tutorlms-migrationtool1 vulnerability
- WP Mega Menu1 vulnerability
- WP Page Builder (WordPress plugin)1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2025-31892MEDIUM | WordPress WP Crowdfunding plugin <= 2.1.15 - Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum WP Crowdfunding wp-crowdfunding allows Stored XSS.This issue affects WP Crowdfunding: from n/a through <= 2.1.15. CWE-79Apr 1, 2025 | CVSS6.5v3.1 | EPSS0.209% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-1508MEDIUM | WP Crowdfunding <= 2.1.14 - Missing Authorization to Authenticated (Subscriber+) Post Content DownloadThe WP Crowdfunding plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the download_data action in all versions up to, and including, 2.1.14. This makes it possible for authenticated attackers, with subscriber-level access and above, to download all of a site's post content when WooCommerce is installed. CWE-862Mar 12, 2025 | CVSS5.3v3.1 | EPSS0.406% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-41870MEDIUM | WordPress WP Crowdfunding plugin <= 2.1.5 - Broken Access Control vulnerabilityMissing Authorization vulnerability in Themeum WP Crowdfunding allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Crowdfunding: from n/a through 2.1.5. CWE-862Dec 13, 2024 | CVSS4.3v3.1 | EPSS0.649% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-11910MEDIUM | WP Crowdfunding <= 2.1.15 - Authenticated (Contributor+) Stored Cross-Site ScriptingThe WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wp-crowdfunding/search block in all versions up to, and including, 2.1.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CWE-79Dec 13, 2024 | CVSS6.4v3.1 | EPSS0.313% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-11911MEDIUM | WP Crowdfunding <= 2.1.12 - Missing Authorization to Authenticated (Subscriber+) WooCommerce InstallationThe WP Crowdfunding plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the install_woocommerce_plugin() function action in all versions up to, and including, 2.1.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install WooCommerce. This has a limited impact on most sites because WooCommerce is a requirement. CWE-862Dec 13, 2024 | CVSS4.3v3.1 | EPSS0.273% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-43937MEDIUM | WordPress WP Crowdfunding plugin <= 2.1.10 - Settings Change vulnerabilityMissing Authorization vulnerability in Themeum WP Crowdfunding allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Crowdfunding: from n/a through 2.1.10. CWE-862Nov 1, 2024 | CVSS6.4v3.1 | EPSS0.358% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-10117MEDIUM | WP Crowdfunding <= 2.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpcf_donate ShortcodeThe WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpcf_donate shortcode in all versions up to, and including, 2.1.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CWE-79Oct 26, 2024 | CVSS6.4v3.1 | EPSS0.37% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-50859MEDIUM | WordPress WP Crowdfunding Plugin <= 2.1.6 is vulnerable to Cross Site Scripting (XSS)Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum WP Crowdfunding allows Stored XSS.This issue affects WP Crowdfunding: from n/a through 2.1.6. CWE-79Dec 28, 2023 | CVSS6.5v3.1 | EPSS0.277% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-47532MEDIUM | WordPress WP Crowdfunding Plugin <= 2.1.6 is vulnerable to Cross Site Scripting (XSS)Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Themeum WP Crowdfunding plugin <= 2.1.6 versions. CWE-79Nov 14, 2023 | CVSS5.8v3.1 | EPSS0.366% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |