Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?Tutor LMSTutor LMS ProTutor LMS Elementor AddonsTutor LMS – Migration ToolIntro Tour Tutorial DeepPresentationTutor LMS BunnyNet IntegrationSertifier Certificate & Badge Maker for WordPress – Tutor LMSTutorStarter
Plugin · tutor
Tutor LMS
94 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 19, 2026Tutor LMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-111407 · affects up to 4.1.2 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Stored XSS.This issue affects Tutor LMS: from n/a through 4.1.2.
Oct 17, 2026Tutor LMS – eLearning and online course solution: Insecure Direct Object ReferenceCVE-2026-92715 · affects up to 4.1.0 · reported by WordfenceMedium 4.3
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the 'ID' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author-level access and above, to modify arbitrary courses created by other instructors — overwriting their title, content, and status — and reassign ownership of those courses to themselves. This is possible because Input::sanitize_array() preserves attacker-supplied POST keys (including 'ID') without stripping them, and WordPress interprets a non-empty ID in the wp_insert_post() argument array as an update to the existing post rather than a new insert.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 16, 2026Tutor LMS – eLearning and online course solution: Stored Cross-Site ScriptingCVE-2026-93681 · affects up to 4.1.0 · reported by WordfenceMedium 6.4
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via display_name Parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that a Legal Consent record exists for the attacker's user account, causing the View Logs button to appear in the wp-admin/users.php Consent Logs column.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 16, 2026Tutor LMS – eLearning and online course solution: DOM-Based Cross-Site ScriptingCVE-2026-88963 · affects up to 4.0.8 · reported by WordfenceMedium 6.1
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via the 'redirect_url' parameter in versions up to, and including, 4.0.8 This is due to insufficient input validation in the Topbar component's back button handler. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in the victim's browser whenever the victim accesses a page that includes the malicious payload.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 15, 2026Tutor LMS: Does not perform a capability check in a routine that regenerates its managed pagesCVE-2026-96537 · fixed in 4.1.1 · reported by WPScanHigh 7.5
The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its managed pages, allowing unauthenticated users to force-publish unpublished pages and overwrite their content, create missing ones, and change the options that reference them.
Oct 14, 2026Tutor LMS – eLearning and online course solution: Reflected Cross-Site ScriptingCVE-2026-100193 · affects up to 4.1.0 · reported by WordfenceMedium 4.7
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the targeted lesson page to have an empty nav-items array — a condition that occurs naturally when a lesson has no post content, no attachments, and comments are disabled or the viewer is not logged in — which bypasses the in_array() tab validation and allows the raw attacker-controlled value to reach the sink.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 10, 2026Tutor LMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-42702 · affects up to 4.1.0 · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Reflected XSS.This issue affects Tutor LMS: from n/a through 4.1.0.
Oct 10, 2026Tutor LMS: Does not verify that the posts named in its course content ordering requests belong to a course the requester managesCVE-2026-85571 · fixed in 4.1.1 · reported by WPScanMedium 6.5
The Tutor LMS WordPress plugin before 4.1.1 does not verify that the posts named in its course content ordering requests belong to a course the requester manages, allowing users with instructor level access to reassign the parent of any post on the site, taking other instructors' course content into their own courses and making arbitrary published content unreachable.
Oct 8, 2026Tutor LMS: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')CVE-2026-42698 · affects up to 4.1.1 · reported by PatchstackMedium 5.3
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Themeum Tutor LMS tutor allows Leveraging Race Conditions.This issue affects Tutor LMS: from n/a through 4.1.1.
Sep 22, 2026Tutor LMS – eLearning and online course solution: Insecure Direct Object ReferenceCVE-2026-18439 · affects up to 4.0.7 · reported by WordfenceMedium 4.3
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.0.7 via the tutor_quiz_builder_save AJAX action due to missing validation that nested question_id, answer_id, deleted_question_ids[], and deleted_answer_ids[] values in the submitted payload belong to a quiz/topic/course the requester is authorized to manage. The handler only validates the top-level course_id, topic_id, and (when supplied) payload['ID'], but the nested identifiers are passed straight into $wpdb->update/DELETE statements in QuizBuilder::save_questions(), QuizBuilder::save_question_answers(), and QuizBuilder::handle_delete(). This makes it possible for authenticated attackers, with Instructor-level access and above, to overwrite the content and re-parent arbitrary quiz questions/answers belonging to other instructors or administrators, and to delete arbitrary quiz question and answer rows.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 18, 2026Tutor LMS – eLearning and online course solution: Insecure Direct Object ReferenceCVE-2026-89333 · affects up to 4.0.8 · reported by WordfenceMedium 6.5
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.0.8 via the 'student_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to disclose the email address and Tutor profile phone number of arbitrary WordPress users, including Administrators, by iterating over user IDs via the student_id parameter.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 18, 2026Tutor LMS – eLearning and online course solution: Reflected Cross-Site ScriptingCVE-2026-89081 · affects up to 4.0.8 · reported by WordfenceMedium 6.1
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in all versions up to, and including, 4.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 18, 2026Tutor LMS – eLearning and online course solution: Authorization bypassCVE-2026-88944 · affects up to 4.0.8 · reported by WordfenceMedium 4.3
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.8. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to permanently delete arbitrary WordPress posts — including pages, courses, quizzes, and WooCommerce products — via wp_delete_post( $id, true ). The exploit chain requires the attacker to first trigger the profile-photo upload flow to obtain an authored wp_posts attachment row, then create a Tutor topic reparented to that attachment, before invoking the lesson deletion handler against any target post ID.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 16, 2026Tutor LMS: Does not check that a user has access to a course before returning its lesson discussion contentCVE-2026-85572 · fixed in 4.0.8 · reported by WPScanMedium 4.3
The Tutor LMS WordPress plugin before 4.0.8 does not check that a user has access to a course before returning its lesson discussion content, allowing any authenticated user, such as a subscriber, to read comments from courses they are not enrolled in, including comments awaiting moderation.
Sep 16, 2026Tutor LMS: Does not correctly determine whether an incoming request is addressed to its own REST APICVE-2026-85569 · fixed in 4.0.8 · reported by WPScanHigh 7.2
The Tutor LMS WordPress plugin before 4.0.8 does not correctly determine whether an incoming request is addressed to its own REST API, and does not enforce the permission recorded against an API credential, allowing the holder of a read-only key to act as the administrator account that issued it.
Sep 12, 2026Tutor LMS – eLearning and online course solution: PHP Object InjectionCVE-2026-78175 · affects up to 4.0.7 · reported by WordfenceHigh 8.8
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7 via the `withdraw_method_field` parameter of the `tutor_save_withdraw_account` AJAX handler. This is due to the handler lacking any capability or role check, relying solely on a nonce, while also passing attacker-supplied values through `esc_sql()`, which replaces every `%` character with a 66-byte HMAC placeholder token before the data is serialized and stored via `update_user_meta()`; when the meta is later retrieved, the placeholder is collapsed back to a single `%`, leaving serialized string length declarations 65 bytes greater than the actual content, and because array keys originate from entirely unescaped POST field names, `unserialize()` over-reads into attacker-controlled bytes, allowing injection of an arbitrary serialized object stream. This makes it possible for authenticated attackers, with subscriber-level access and above, to achieve remote code execution on the server by triggering the `GuzzleHttp\Cookie\FileCookieJar` POP chain, reachable via the `spl_autoload_register` loader in `TUTOR\RestAPI` which loads the
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 28, 2026Tutor LMS – eLearning and online course solution: Remote Code Execution limited to zero-argument function invocationCVE-2026-16759 · affects up to 4.0.5 · reported by WordfenceMedium 6.5
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument function invocation in all versions up to, and including, 4.0.5 via the tutor_course_filter_ajax AJAX action. This is due to missing authorization on the handler combined with unsanitized array keys being passed to extract() inside tutor_load_template(), allowing attacker-controlled POST data to overwrite the local $template variable and, in the resulting templates/single-content-loader.php template, the $method_map and $context variables invoked at $method_map[$context](). This makes it possible for unauthenticated attackers to call an arbitrary zero-argument PHP function server-side and, via WordPress core edit_user(), to create a persistent subscriber-level account from request parameters.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 27, 2026Tutor LMS: Does not prevent request data from overwriting internal variables while rendering templatesCVE-2026-19092 · fixed in 4.0.6 · reported by WPScanCritical 9.8
The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output.
Aug 26, 2026Tutor LMS: Does not validate values used to build a database queryCVE-2026-19094 · fixed in 4.0.6 · reported by WPScanMedium 5.3
The Tutor LMS WordPress plugin before 4.0.6 does not validate values used to build a database query, and does not restrict which template file a request may load, allowing unauthenticated users to inject SQL and to read question and answer content belonging to courses that are not publicly available. The injected text reaches the query as grammar rather than as data, and on the database engines tested it does not yield extraction of arbitrary data, so the confidentiality impact is the disclosed course content rather than the database at large.
Aug 22, 2026Tutor LMS: Does not validate a stored file path before using it to stream mediaCVE-2026-19093 · fixed in 4.0.6 · reported by WPScanMedium 6.8
The Tutor LMS WordPress plugin before 4.0.6 does not validate a stored file path before using it to stream media, allowing users with the instructor role to read arbitrary files on the server, including files outside the web root. The readable files include the WordPress configuration file, which exposes the database credentials and the authentication keys and salts, so authentication cookies can be forged.
Aug 22, 2026Tutor LMS: Does not enforce per-object ownership checks on its course content typeCVE-2026-14187 · fixed in 4.0.6 · reported by WPScanLow 2.7
The Tutor LMS WordPress plugin before 4.0.6 does not enforce per-object ownership checks on its course content type, allowing any user with the instructor role to read the content of private courses belonging to other instructors.
Aug 6, 2026Tutor LMS: Does not properly verify enrollmentCVE-2026-14306 · fixed in 3.9.14 · reported by WPScanMedium 4.3
The Tutor LMS WordPress plugin before 3.9.14 does not properly verify enrollment when restricting access to protected course content, allowing authenticated users with subscriber-level access and above who are enrolled in at least one course to view paid lesson, quiz, and assignment content belonging to other courses.
Jul 30, 2026Tutor LMS: Does not properly verify that a user has access to the course a Q&A thread belongs to before returning or writing to that threadCVE-2026-14310 · fixed in 4.0.0 · reported by WPScanMedium 5.4
The Tutor LMS WordPress plugin before 4.0.0 does not properly verify that a user has access to the course a Q&A thread belongs to before returning or writing to that thread, allowing authenticated users with subscriber-level access and above who can access any single course to read the Q&A threads of other courses and to inject replies into them.
Jul 28, 2026Tutor LMS – eLearning and online course solution: Generic SQL InjectionCVE-2026-15444 · affects up to 4.0.1 · reported by WordfenceMedium 4.9
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the 'coupon_code' parameter in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 16, 2026Tutor LMS – eLearning and online course solution: Generic SQL InjectionCVE-2026-15022 · affects up to 4.0.0 · reported by WordfenceMedium 6.5
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via Stored Quiz Answer Array in all versions up to, and including, 4.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The payload is stored at quiz-attempt time via the wp_ajax_tutor_quiz_abandon handler, but the injected SQL executes only when a privileged user or Tutor REST API key holder requests the /wp-json/tutor/v1/quiz-attempt-details/{id} endpoint, making this a second-order (stored) injection chain.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 13, 2026Tutor LMS: Authorization Bypass Through User-Controlled KeyCVE-2026-57694 · affects up to 3.9.13 · reported by PatchstackMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through <= 3.9.13.
Jul 13, 2026Tutor LMS: Does notCVE-2026-12275 · fixed in 3.9.13 · reported by WPScanHigh 7.1
The Tutor LMS WordPress plugin before 3.9.13 does not, in its Droip and Kirki page-builder integration, perform the enrollment, purchase, and private-course capability checks it enforces in its core course handler, allowing authenticated users with subscriber-level access to enroll in paid or private courses without authorization, read private course content, and mark arbitrary courses as completed, on sites where the Droip or Kirki integration is active.
Jul 13, 2026Tutor LMS: Does not verify that the requesting user is allowed to edit a target post before overwriting it in one of its content-builder save handlersCVE-2026-12274 · fixed in 3.9.13 · reported by WPScanMedium 6.5
The Tutor LMS WordPress plugin before 3.9.13 does not verify that the requesting user is allowed to edit a target post before overwriting it in one of its content-builder save handlers, authorizing the request only against an unrelated identifier, allowing authenticated users with instructor-level access to overwrite and take over any post or page on the site, including those owned by administrators.
Jul 13, 2026Tutor LMS: Does not perform any authorization or post-target validation before creating a comment in one of its handlersCVE-2026-12273 · fixed in 3.9.13 · reported by WPScanMedium 4.3
The Tutor LMS WordPress plugin before 3.9.13 does not perform any authorization or post-target validation before creating a comment in one of its handlers, and stores the comment pre-approved, allowing authenticated users with subscriber-level access and above to post auto-approved comments containing arbitrary HTML and links on any content across the site, bypassing the comment moderation queue.
Jul 13, 2026Tutor LMS: Does not verify ownership of the targeted quiz attempt before writing to itCVE-2026-12271 · fixed in 3.9.13 · reported by WPScanMedium 5.4
The Tutor LMS WordPress plugin before 3.9.13 does not verify ownership of the targeted quiz attempt before writing to it, allowing authenticated users with subscriber-level access and above to modify and force-complete other students' quiz attempts, overwriting their recorded marks and pass/fail result.
Jul 1, 2026Tutor LMS – eLearning and online course solution: Stored Cross-Site ScriptingCVE-2026-13443 · affects up to 3.9.13 · reported by WordfenceMedium 6.4
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Lesson Attachment Title in all versions up to, and including, 3.9.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 18, 2026Tutor LMS – eLearning and online course solution: Generic SQL InjectionCVE-2026-10736 · affects up to 3.9.11 · reported by WordfenceMedium 4.9
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the 'data' parameter in all versions up to, and including, 3.9.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 15, 2026Unauthenticated Broken Access Control in Tutor LMS <= 3.9.7 versions.CVE-2026-40743 · affects up to 3.9.7 · reported by PatchstackMedium 6.5
Unauthenticated Broken Access Control in Tutor LMS <= 3.9.7 versions.
May 13, 2026Tutor LMS – eLearning and online course solution: Insecure Direct Object ReferenceCVE-2026-6965 · affects up to 3.9.9 · reported by WordfenceMedium 5.3
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 3.9.9. This is due to the `get_course_id_by()` function unconditionally trusting the user-supplied `course` GET parameter as the authoritative course ID for content ownership lookups, which is then consumed by `can_user_manage()`, the plugin's sole authorization gate for instructor-level operations, causing it to evaluate instructor membership against the attacker-controlled course rather than the course that actually owns the target content object. This makes it possible for authenticated attackers, with instructor-level access and above, to perform unauthorized operations on any other instructor's course content, including permanently deleting lessons, assignments, quizzes (with cascading deletion of all student attempt data), topics, announcements, and Q&A threads, as well as creating or modifying lessons, topics, and announcements in victim courses, manipulating student quiz grades, and reading unpublished lesson and quiz content.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 17, 2026Tutor LMS: SQL InjectionCVE-2026-6080 · affects up to 3.9.8 · reported by WordfenceMedium 6.5
The Tutor LMS plugin for WordPress is vulnerable to SQL Injection in versions up to and including 3.9.8. This is due to insufficient escaping on the 'date' parameter combined with direct interpolation into a SQL fragment before being passed to $wpdb->prepare(). This makes it possible for authenticated attackers with Admin-level access and above to append additional SQL queries and extract sensitive information from the database.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 17, 2026Tutor LMS – eLearning and online course solution: Unauthorized course content manipulationCVE-2026-5502 · affects up to 3.9.8 · reported by WordfenceMedium 5.3
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized course content manipulation in versions up to and including 3.9.8. This is due to a missing authorization check in the tutor_update_course_content_order() function. The function only validates the nonce (CSRF protection) but does not verify whether the user has permission to manage course content. The can_user_manage() authorization check only executes when the 'content_parent' parameter is present in the request. When this parameter is omitted, the function proceeds directly to save_course_content_order() which manipulates the wp_posts table without any authorization validation. This makes it possible for authenticated attackers with subscriber-level access and above to detach all lessons from any topic, move lessons between topics, and modify the menu_order of course content, effectively allowing them to disrupt the structure of any course on the site.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 15, 2026Tutor LMS: Missing AuthorizationCVE-2026-40740 · affects up to 3.9.7 · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through <= 3.9.7.
Apr 10, 2026Tutor LMS – eLearning and online course solution: Insecure Direct Object ReferenceCVE-2026-3371 · affects up to 3.9.7 · reported by WordfenceMedium 4.3
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.9.7. This is due to missing authorization checks in the `save_course_content_order()` private method, which is called unconditionally by the `tutor_update_course_content_order` AJAX handler. While the handler's `content_parent` branch includes a `can_user_manage()` check, the `save_course_content_order()` call processes attacker-supplied `tutor_topics_lessons_sorting` JSON without any ownership or capability verification. This makes it possible for authenticated attackers with Subscriber-level access or above to detach lessons from topics, reorder course content, and reassign lessons between topics in any course, including admin-owned courses, by sending a crafted AJAX request with manipulated topic and lesson IDs.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 10, 2026Tutor LMS – eLearning and online course solution: Unauthorized private course enrollmentCVE-2026-3358 · affects up to 3.9.7 · reported by WordfenceMedium 5.4
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized private course enrollment in all versions up to, and including, 3.9.7. This is due to missing post_status validation in the `enroll_now()` and `course_enrollment()` functions. Both enrollment endpoints verify the nonce, user authentication, and whether the course is purchasable, but fail to check if the course has a `private` post_status. This makes it possible for authenticated attackers with Subscriber-level access or above to enroll in private courses by sending a crafted POST request with the target course ID. The enrollment record is created in the database and the private course title and enrollment status are exposed in the subscriber's dashboard, though WordPress core access control prevents the subscriber from viewing the actual course content (returns 404). Enrollment in private courses should be restricted to users with the `read_private_posts` capability.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 9, 2026Tutor LMS – eLearning and online course solution: An Insecure Direct Object ReferenceCVE-2026-3360 · affects up to 3.9.7 · reported by WordfenceHigh 7.5
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to an Insecure Direct Object Reference in all versions up to, and including, 3.9.7. This is due to missing authentication and authorization checks in the `pay_incomplete_order()` function. The function accepts an attacker-controlled `order_id` parameter and uses it to look up order data, then writes billing fields to the order owner's profile (`$order_data->user_id`) without verifying the requester's identity or ownership. Because the Tutor nonce (`_tutor_nonce`) is exposed on public frontend pages, this makes it possible for unauthenticated attackers to overwrite the billing profile (name, email, phone, address) of any user who has an incomplete manual order, by sending a crafted POST request with a guessed or enumerated `order_id`.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 19, 2026Tutor LMS: Authorization Bypass Through User-Controlled KeyCVE-2025-32223 · affects up to 3.9.4 · reported by PatchstackMedium 6.5
Authorization Bypass Through User-Controlled Key vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through <= 3.9.4.
Mar 5, 2026Tutor LMS: Missing AuthorizationCVE-2026-23799 · affects up to 3.9.5 · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through <= 3.9.5.
Feb 28, 2026Tutor LMS – eLearning and online course solution: SQL InjectionCVE-2025-13673 · affects up to 3.9.6 · reported by WordfenceHigh 7.5
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to SQL Injection via the 'coupon_code' parameter in all versions up to, and including, 3.9.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. NOTE: This vulnerability was partially mitigated in versions 3.9.4 and 3.9.6.
Feb 3, 2026Tutor LMS – eLearning and online course solution: Insecure Direct Object References (IDOR)CVE-2026-1375 · affects up to 3.9.5 · reported by WordfenceHigh 8.1
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object References (IDOR) in all versions up to, and including, 3.9.5. This is due to missing object-level authorization checks in the `course_list_bulk_action()`, `bulk_delete_course()`, and `update_course_status()` functions. This makes it possible for authenticated attackers, with Tutor Instructor-level access and above, to modify or delete arbitrary courses they do not own by manipulating course IDs in bulk action requests.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 3, 2026Tutor LMS – eLearning and online course solution: Sensitive Information ExposureCVE-2026-1371 · affects up to 3.9.5 · reported by WordfenceMedium 5.3
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.5. This is due to missing authorization checks in the `ajax_coupon_details()` function, which only validates nonces but does not verify user capabilities. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive coupon information including coupon codes, discount amounts, usage statistics, and course/bundle applications.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 22, 2026Tutor LMS: Authorization Bypass Through User-Controlled KeyCVE-2025-47555 · affects up to 3.9.4 · reported by PatchstackLow 3.8
Authorization Bypass Through User-Controlled Key vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through <= 3.9.4.
Jan 20, 2026Tutor LMS – eLearning and online course solution: Unauthorized attachment deletionCVE-2026-0548 · affects up to 3.9.4 · reported by WordfenceMedium 5.4
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized attachment deletion due to a missing capability check on the `delete_existing_user_photo` function in all versions up to, and including, 3.9.4. This makes it possible for authenticated attackers, with subscriber level access and above, to delete arbitrary attachments on the site.
Jan 9, 2026Tutor LMS – eLearning and online course solution: Unauthorized course completionCVE-2025-13935 · affects up to 3.9.2 · reported by WordfenceMedium 4.3
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized course completion in all versions up to, and including, 3.9.2. This is due to missing enrollment verification in the 'mark_course_complete' function. This makes it possible for authenticated attackers, with subscriber level access and above, to mark any course as completed.
Jan 9, 2026Tutor LMS – eLearning and online course solution: Unauthorized course enrollmentCVE-2025-13934 · affects up to 3.9.3 · reported by WordfenceMedium 4.3
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized course enrollment in all versions up to, and including, 3.9.3. This is due to a missing capability check and purchasability validation in the `course_enrollment()` AJAX handler. This makes it possible for authenticated attackers, with subscriber level access and above, to enroll themselves in any course without going through the proper purchase flow.
Jan 9, 2026Tutor LMS – eLearning and online course solution: Unauthorized modification and deletion of dataCVE-2025-13628 · affects up to 3.9.3 · reported by WordfenceMedium 4.3
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification and deletion of data due to a missing capability check on the 'bulk_action_handler' and 'coupon_permanent_delete' functions in all versions up to, and including, 3.9.3. This makes it possible for authenticated attackers, with subscriber level access and above, to delete, activate, deactivate, or trash arbitrary coupons.
Jan 8, 2026Tutor LMS – eLearning and online course solution: Unauthorized access of dataCVE-2025-13679 · affects up to 3.9.3 · reported by WordfenceMedium 6.5
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_order_by_id() function in all versions up to, and including, 3.9.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enumerate order IDs and exfiltrate sensitive data (PII), such as student name, email address, phone number, and billing address.
Oct 25, 2025Tutor LMS – eLearning and online course solution: Sensitive Information ExposureCVE-2025-6680 · affects up to 3.8.3 · reported by WordfenceMedium 4.3
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.8.3. This makes it possible for authenticated attackers, with tutor-level access and above, to view assignments for courses they don't teach which may contain sensitive information.
Oct 25, 2025Tutor LMS Pro – eLearning and online course solution: Insecure Direct Object ReferenceCVE-2025-6639 · affects up to 3.8.3 · reported by WordfenceMedium 5.4
The Tutor LMS Pro – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.8.3 due to missing validation on a user controlled key when viewing and editing assignments through the tutor_assignment_submit() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view and edit assignment submissions of other students.
Oct 25, 2025Tutor LMS – eLearning and online course solution: Unauthorized modification of dataCVE-2025-11564 · affects up to 3.8.3 · reported by WordfenceMedium 5.3
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check while verifying webhook signatures on the "verifyAndCreateOrderData" function in all versions up to, and including, 3.8.3. This makes it possible for unauthenticated attackers to bypass payment verification and mark orders as paid by submitting forged webhook requests with `payment_type` set to 'recurring'.
Sep 9, 2025Tutor LMS: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-58993 · affects up to 3.7.4 · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS tutor allows SQL Injection.This issue affects Tutor LMS: from n/a through <= 3.7.4.
Aug 13, 2025Tutor LMS Pro – eLearning and online course solution: Time-based SQL InjectionCVE-2025-6184 · affects up to 3.7.0 · reported by WordfenceHigh 8.8
The Tutor LMS Pro – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter used in the get_submitted_assignments() function in all versions up to, and including, 3.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Tutor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Only the Pro version is affected.
Apr 10, 2025Tutor LMS: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2025-32230 · affects up to 3.4.0 · reported by PatchstackMedium 4.3
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Themeum Tutor LMS tutor.This issue affects Tutor LMS: from n/a through <= 3.4.0.
Nov 21, 2024Tutor LMS: SQL InjectionCVE-2024-10400 · affects up to 2.7.6 · reported by WordfenceHigh 7.5
The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via the ‘rating_filter’ parameter in all versions up to, and including, 2.7.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Nov 21, 2024Tutor LMS: Bypass to user registrationCVE-2024-10393 · affects up to 2.7.6 · reported by WordfenceMedium 5.3
The Tutor LMS plugin for WordPress is vulnerable to bypass to user registration in versions up to, and including, 2.7.6. This is due to a missing check for the 'users_can_register' option in the 'register_instructor' function. This makes it possible for unauthenticated attackers to register as the default role on the site, even if registration is disabled.
Nov 1, 2024Tutor LMS: Missing AuthorizationCVE-2024-43142 · affects up to 2.7.3 · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Themeum Tutor LMS allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through 2.7.3.
Sep 10, 2024Tutor LMS: Cross-Site Request ForgeryCVE-2023-2919 · affects up to 2.7.4 · reported by WordfenceMedium 4.3
The Tutor LMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.4. This is due to missing or incorrect nonce validation on the 'addon_enable_disable' function. This makes it possible for unauthenticated attackers to enable or disable addons via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 26, 2024Tutor LMS: Cross-Site Request Forgery (CSRF)CVE-2024-39645 · affects up to 2.7.2 · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a through 2.7.2.
Aug 18, 2024Tutor LMS: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-43282 · affects up to 2.7.2 · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a through 2.7.2.
Aug 12, 2024Tutor LMS: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43231 · affects up to 2.7.3 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themeum Tutor LMS allows Stored XSS.This issue affects Tutor LMS: from n/a through 2.7.3.
Jul 20, 2024Tutor LMS: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37947 · affects up to 2.7.2 · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themeum Tutor LMS allows Stored XSS.This issue affects Tutor LMS: from n/a through 2.7.2.
Jul 9, 2024Tutor LMS: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-37266 · affects up to 2.7.1 · reported by PatchstackMedium 4.9
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themeum Tutor LMS allows Path Traversal.This issue affects Tutor LMS: from n/a through 2.7.1.
Jul 9, 2024Tutor LMS: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-37256 · affects up to 2.7.1 · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a through 2.7.1.
Jun 11, 2024Tutor LMS: Missing AuthorizationCVE-2023-25799 · affects up to 2.1.8 · reported by PatchstackHigh 8.3
Missing Authorization vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a through 2.1.8.
Jun 7, 2024Tutor LMS – eLearning and online course solution: Insecure Direct Object ReferenceCVE-2024-5438 · affects up to 2.7.1 · reported by WordfenceMedium 4.3
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.7.1 via the 'attempt_delete' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Instructor-level access and above, to delete arbitrary quiz attempts.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 7, 2024Tutor LMS – eLearning and online course solution: Time-based SQL InjectionCVE-2024-4902 · affects up to 2.7.1 · reported by WordfenceHigh 7.2
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the ‘course_id’ parameter in all versions up to, and including, 2.7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with admin access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CVE-2024-37256 is likely a duplicate of this issue.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 16, 2024Tutor LMS: Unauthorized access of data, modification of data, loss of dataCVE-2024-4223 · affects up to 2.7.0 · reported by WordfenceCritical 9.8
The Tutor LMS plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on multiple functions in all versions up to, and including, 2.7.0. This makes it possible for unauthenticated attackers to add, modify, or delete data.
May 16, 2024Tutor LMS: Time-based SQL InjectionCVE-2024-4318 · affects up to 2.7.0 · reported by WordfenceHigh 8.8
The Tutor LMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘question_id’ parameter in versions up to, and including, 2.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Instructor-level permissions and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 16, 2024Tutor LMS – eLearning and online course solution: Insecure Direct Object Reference to Arbitrary Course DeletionCVE-2024-4279 · affects up to 2.7.0 · reported by WordfenceMedium 6.5
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference to Arbitrary Course Deletion in versions up to, and including, 2.7.0 via the 'tutor_course_delete' function due to missing validation on a user controlled key. This can allow authenticated attackers, with Instructor-level permissions and above, to delete any course.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 2, 2024Tutor LMS – eLearning and online course solution: Unauthorized modification of dataCVE-2024-3553 · affects up to 2.6.2 · reported by WordfenceMedium 6.5
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the hide_notices function in all versions up to, and including, 2.6.2. This makes it possible for unauthenticated attackers to enable user registration on sites that may have it disabled.
Apr 25, 2024Tutor LMS – eLearning and online course solution: Stored Cross-Site ScriptingCVE-2024-3994 · affects up to 2.6.2 · reported by WordfenceMedium 5.4
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tutor_instructor_list' shortcode in all versions up to, and including, 2.6.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Mar 20, 2024Tutor LMS – eLearning and online course solution: Cross-Site Request ForgeryCVE-2024-1503 · affects up to 2.6.1 · reported by WordfenceMedium 4.3
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.1. This is due to missing or incorrect nonce validation on the erase_tutor_data() function. This makes it possible for unauthenticated attackers to deactivate the plugin and erase all data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This requires the "Erase upon uninstallation" option to be enabled.
Mar 20, 2024Tutor LMS – eLearning and online course solution: Unauthorized loss of dataCVE-2024-1502 · affects up to 2.6.1 · reported by WordfenceMedium 5.4
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the tutor_delete_announcement() function in all versions up to, and including, 2.6.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary posts.
Mar 13, 2024Tutor LMS – eLearning and online course solution: Time-based SQL InjectionCVE-2024-1751 · affects up to 2.6.1 · reported by WordfenceHigh 8.8
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the question_id parameter in all versions up to, and including, 2.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber/student access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 28, 2024Tutor LMS – eLearning and online course solution: Unauthorized access of restricted Q&A contentCVE-2024-1133 · affects up to 2.6.0 · reported by WordfenceMedium 4.3
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized access of restricted Q&A content due to a missing capability check when interacting with questions in all versions up to, and including, 2.6.0. This makes it possible for authenticated attackers, with subscriber access or higher, to interact with questions in courses in which they are not enrolled including private courses.
Feb 28, 2024Tutor LMS – eLearning and online course solution: HTML InjectionCVE-2024-1128 · affects up to 2.6.0 · reported by WordfenceMedium 5.4
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 2.6.0. This is due to insufficient sanitization of HTML input in the Q&A functionality. This makes it possible for authenticated attackers, with Student access and above, to inject arbitrary HTML onto a site, though it does not allow Cross-Site Scripting
Dec 15, 2023Tutor LMS – eLearning and online course solution: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49829 · affects up to 2.2.4 · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS – eLearning and online course solution allows Stored XSS.This issue affects Tutor LMS – eLearning and online course solution: from n/a through 2.2.4.
Nov 3, 2023Tutor LMS: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-25990 · affects up to 2.1.10 · reported by PatchstackHigh 7.1
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS allows SQL Injection.This issue affects Tutor LMS: from n/a through 2.1.10.
Nov 3, 2023Tutor LMS: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-25800 · affects up to 2.2.0 · reported by PatchstackHigh 8.1
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS allows SQL Injection.This issue affects Tutor LMS: from n/a through 2.2.0.
Nov 3, 2023Tutor LMS: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-25700 · affects up to 2.1.10 · reported by PatchstackHigh 8.2
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS allows SQL Injection.This issue affects Tutor LMS: from n/a through 2.1.10.
Oct 16, 2023Tutor LMS: Does not sanitise and escape some of its settingsCVE-2023-4805 · fixed in 2.3.0 · reported by WPScanMedium 5.4
The Tutor LMS WordPress plugin before 2.3.0 does not sanitise and escape some of its settings, which could allow users such as subscriber to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Jul 4, 2023Tutor LMS: Does not implement adequate permission checks for REST API endpointsCVE-2023-3133 · fixed in 2.2.1 · reported by WPScanHigh 7.5
The Tutor LMS WordPress plugin before 2.2.1 does not implement adequate permission checks for REST API endpoints, allowing unauthenticated attackers to access information from Lessons that should not be publicly available.
Feb 6, 2023Tutor LMS: Does not sanitise and escape the reset_key and user_id parameters before outputting then back in attributesCVE-2023-0236 · fixed in 2.0.10 · reported by WPScanMedium 6.1
The Tutor LMS WordPress plugin before 2.0.10 does not sanitise and escape the reset_key and user_id parameters before outputting then back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Oct 17, 2022Tutor LMS: Does not escape some course parametersCVE-2022-2563 · fixed in 2.0.10 · reported by WPScanMedium 4.8
The Tutor LMS WordPress plugin before 2.0.10 does not escape some course parameters, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Jan 24, 2022Tutor LMS: Does not escape the search parameter before outputting it back in an attribute in an admin pageCVE-2021-25017 · fixed in 1.9.12 · reported by WPScanMedium 6.1
The Tutor LMS WordPress plugin before 1.9.12 does not escape the search parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
Nov 23, 2021Tutor LMS: Does not sanitise and escape user input before outputting back in attributes in the Student Registration pageCVE-2021-24873 · fixed in 1.9.11 · reported by WPScanMedium 6.1
The Tutor LMS WordPress plugin before 1.9.11 does not sanitise and escape user input before outputting back in attributes in the Student Registration page, leading to a Reflected Cross-Site Scripting issue
Oct 18, 2021Tutor LMS: Does not escape some of its settings before outputting them in attributesCVE-2021-24740 · fixed in 1.9.9 · reported by WPScanMedium 4.8
The Tutor LMS WordPress plugin before 1.9.9 does not escape some of its settings before outputting them in attributes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Aug 2, 2021Tutor LMS – eLearning and online course solution: Did not escape the Summary field of Announcements (when outputting it in an attribute)CVE-2021-24455 · fixed in 1.9.2 · reported by WPScanMedium 5.4
The Tutor LMS – eLearning and online course solution WordPress plugin before 1.9.2 did not escape the Summary field of Announcements (when outputting it in an attribute), which can be created by users as low as Tutor Instructor. This lead to a Stored Cross-Site Scripting issue, which is triggered when viewing the Announcements list, and could result in privilege escalation when viewed by an admin.
Apr 22, 2021Tutor LMS – eLearning and online course solution: Is affected by a local file inclusion vulnerability through the maliciously constructed sub_page parameter of the plugin's ToolsCVE-2021-24242 · fixed in 1.8.8 · reported by WPScanLow 3.8
The Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.8 is affected by a local file inclusion vulnerability through the maliciously constructed sub_page parameter of the plugin's Tools, allowing high privilege users to include any local php file
Apr 5, 2021Several AJAX endpoints in the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 were unprotected, allowing students to modify coursCVE-2021-24184 · fixed in 1.7.7 · reported by WPScanHigh 8.8
Several AJAX endpoints in the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 were unprotected, allowing students to modify course information and elevate their privileges among many other actions.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.