Is Tutor LMS safe?

Every recorded flaw

• Oct 19, 2026Tutor LMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-111407 · affects up to 4.1.2 · reported by PatchstackMedium 6.5
• Oct 17, 2026Tutor LMS – eLearning and online course solution: Insecure Direct Object ReferenceCVE-2026-92715 · affects up to 4.1.0 · reported by WordfenceMedium 4.3
• Oct 16, 2026Tutor LMS – eLearning and online course solution: Stored Cross-Site ScriptingCVE-2026-93681 · affects up to 4.1.0 · reported by WordfenceMedium 6.4
• Oct 16, 2026Tutor LMS – eLearning and online course solution: DOM-Based Cross-Site ScriptingCVE-2026-88963 · affects up to 4.0.8 · reported by WordfenceMedium 6.1
• Oct 15, 2026Tutor LMS: Does not perform a capability check in a routine that regenerates its managed pagesCVE-2026-96537 · fixed in 4.1.1 · reported by WPScanHigh 7.5
• Oct 14, 2026Tutor LMS – eLearning and online course solution: Reflected Cross-Site ScriptingCVE-2026-100193 · affects up to 4.1.0 · reported by WordfenceMedium 4.7
• Oct 10, 2026Tutor LMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-42702 · affects up to 4.1.0 · reported by PatchstackHigh 7.1
• Oct 10, 2026Tutor LMS: Does not verify that the posts named in its course content ordering requests belong to a course the requester managesCVE-2026-85571 · fixed in 4.1.1 · reported by WPScanMedium 6.5
• Oct 8, 2026Tutor LMS: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')CVE-2026-42698 · affects up to 4.1.1 · reported by PatchstackMedium 5.3
• Sep 22, 2026Tutor LMS – eLearning and online course solution: Insecure Direct Object ReferenceCVE-2026-18439 · affects up to 4.0.7 · reported by WordfenceMedium 4.3
• Sep 18, 2026Tutor LMS – eLearning and online course solution: Insecure Direct Object ReferenceCVE-2026-89333 · affects up to 4.0.8 · reported by WordfenceMedium 6.5
• Sep 18, 2026Tutor LMS – eLearning and online course solution: Reflected Cross-Site ScriptingCVE-2026-89081 · affects up to 4.0.8 · reported by WordfenceMedium 6.1
• Sep 18, 2026Tutor LMS – eLearning and online course solution: Authorization bypassCVE-2026-88944 · affects up to 4.0.8 · reported by WordfenceMedium 4.3
• Sep 16, 2026Tutor LMS: Does not check that a user has access to a course before returning its lesson discussion contentCVE-2026-85572 · fixed in 4.0.8 · reported by WPScanMedium 4.3
• Sep 16, 2026Tutor LMS: Does not correctly determine whether an incoming request is addressed to its own REST APICVE-2026-85569 · fixed in 4.0.8 · reported by WPScanHigh 7.2
• Sep 12, 2026Tutor LMS – eLearning and online course solution: PHP Object InjectionCVE-2026-78175 · affects up to 4.0.7 · reported by Wordfence1.1% oddsHigh 8.8
• Aug 28, 2026Tutor LMS – eLearning and online course solution: Remote Code Execution limited to zero-argument function invocationCVE-2026-16759 · affects up to 4.0.5 · reported by WordfenceMedium 6.5
• Aug 27, 2026Tutor LMS: Does not prevent request data from overwriting internal variables while rendering templatesCVE-2026-19092 · fixed in 4.0.6 · reported by WPScan2.6% oddsCritical 9.8
• Aug 26, 2026Tutor LMS: Does not validate values used to build a database queryCVE-2026-19094 · fixed in 4.0.6 · reported by WPScanMedium 5.3
• Aug 22, 2026Tutor LMS: Does not validate a stored file path before using it to stream mediaCVE-2026-19093 · fixed in 4.0.6 · reported by WPScanMedium 6.8
• Aug 22, 2026Tutor LMS: Does not enforce per-object ownership checks on its course content typeCVE-2026-14187 · fixed in 4.0.6 · reported by WPScanLow 2.7
• Aug 6, 2026Tutor LMS: Does not properly verify enrollmentCVE-2026-14306 · fixed in 3.9.14 · reported by WPScanMedium 4.3
• Jul 30, 2026Tutor LMS: Does not properly verify that a user has access to the course a Q&A thread belongs to before returning or writing to that threadCVE-2026-14310 · fixed in 4.0.0 · reported by WPScanMedium 5.4
• Jul 28, 2026Tutor LMS – eLearning and online course solution: Generic SQL InjectionCVE-2026-15444 · affects up to 4.0.1 · reported by WordfenceMedium 4.9
• Jul 16, 2026Tutor LMS – eLearning and online course solution: Generic SQL InjectionCVE-2026-15022 · affects up to 4.0.0 · reported by WordfenceMedium 6.5
• Jul 13, 2026Tutor LMS: Authorization Bypass Through User-Controlled KeyCVE-2026-57694 · affects up to 3.9.13 · reported by PatchstackMedium 6.5
• Jul 13, 2026Tutor LMS: Does notCVE-2026-12275 · fixed in 3.9.13 · reported by WPScanHigh 7.1
• Jul 13, 2026Tutor LMS: Does not verify that the requesting user is allowed to edit a target post before overwriting it in one of its content-builder save handlersCVE-2026-12274 · fixed in 3.9.13 · reported by WPScanMedium 6.5
• Jul 13, 2026Tutor LMS: Does not perform any authorization or post-target validation before creating a comment in one of its handlersCVE-2026-12273 · fixed in 3.9.13 · reported by WPScanMedium 4.3
• Jul 13, 2026Tutor LMS: Does not verify ownership of the targeted quiz attempt before writing to itCVE-2026-12271 · fixed in 3.9.13 · reported by WPScanMedium 5.4
• Jul 1, 2026Tutor LMS – eLearning and online course solution: Stored Cross-Site ScriptingCVE-2026-13443 · affects up to 3.9.13 · reported by WordfenceMedium 6.4
• Jun 18, 2026Tutor LMS – eLearning and online course solution: Generic SQL InjectionCVE-2026-10736 · affects up to 3.9.11 · reported by WordfenceMedium 4.9
• Jun 15, 2026Unauthenticated Broken Access Control in Tutor LMS <= 3.9.7 versions.CVE-2026-40743 · affects up to 3.9.7 · reported by PatchstackMedium 6.5
• May 13, 2026Tutor LMS – eLearning and online course solution: Insecure Direct Object ReferenceCVE-2026-6965 · affects up to 3.9.9 · reported by WordfenceMedium 5.3
• Apr 17, 2026Tutor LMS: SQL InjectionCVE-2026-6080 · affects up to 3.9.8 · reported by WordfenceMedium 6.5
• Apr 17, 2026Tutor LMS – eLearning and online course solution: Unauthorized course content manipulationCVE-2026-5502 · affects up to 3.9.8 · reported by WordfenceMedium 5.3
• Apr 15, 2026Tutor LMS: Missing AuthorizationCVE-2026-40740 · affects up to 3.9.7 · reported by PatchstackMedium 5.4
• Apr 10, 2026Tutor LMS – eLearning and online course solution: Insecure Direct Object ReferenceCVE-2026-3371 · affects up to 3.9.7 · reported by WordfenceMedium 4.3
• Apr 10, 2026Tutor LMS – eLearning and online course solution: Unauthorized private course enrollmentCVE-2026-3358 · affects up to 3.9.7 · reported by WordfenceMedium 5.4
• Apr 9, 2026Tutor LMS – eLearning and online course solution: An Insecure Direct Object ReferenceCVE-2026-3360 · affects up to 3.9.7 · reported by WordfenceHigh 7.5
• Mar 19, 2026Tutor LMS: Authorization Bypass Through User-Controlled KeyCVE-2025-32223 · affects up to 3.9.4 · reported by PatchstackMedium 6.5
• Mar 5, 2026Tutor LMS: Missing AuthorizationCVE-2026-23799 · affects up to 3.9.5 · reported by PatchstackMedium 6.5
• Feb 28, 2026Tutor LMS – eLearning and online course solution: SQL InjectionCVE-2025-13673 · affects up to 3.9.6 · reported by WordfenceHigh 7.5
• Feb 3, 2026Tutor LMS – eLearning and online course solution: Insecure Direct Object References (IDOR)CVE-2026-1375 · affects up to 3.9.5 · reported by WordfenceHigh 8.1
• Feb 3, 2026Tutor LMS – eLearning and online course solution: Sensitive Information ExposureCVE-2026-1371 · affects up to 3.9.5 · reported by WordfenceMedium 5.3
• Jan 22, 2026Tutor LMS: Authorization Bypass Through User-Controlled KeyCVE-2025-47555 · affects up to 3.9.4 · reported by PatchstackLow 3.8
• Jan 20, 2026Tutor LMS – eLearning and online course solution: Unauthorized attachment deletionCVE-2026-0548 · affects up to 3.9.4 · reported by WordfenceMedium 5.4
• Jan 9, 2026Tutor LMS – eLearning and online course solution: Unauthorized course completionCVE-2025-13935 · affects up to 3.9.2 · reported by WordfenceMedium 4.3
• Jan 9, 2026Tutor LMS – eLearning and online course solution: Unauthorized course enrollmentCVE-2025-13934 · affects up to 3.9.3 · reported by WordfenceMedium 4.3
• Jan 9, 2026Tutor LMS – eLearning and online course solution: Unauthorized modification and deletion of dataCVE-2025-13628 · affects up to 3.9.3 · reported by WordfenceMedium 4.3
• Jan 8, 2026Tutor LMS – eLearning and online course solution: Unauthorized access of dataCVE-2025-13679 · affects up to 3.9.3 · reported by WordfenceMedium 6.5
• Oct 25, 2025Tutor LMS – eLearning and online course solution: Sensitive Information ExposureCVE-2025-6680 · affects up to 3.8.3 · reported by WordfenceMedium 4.3
• Oct 25, 2025Tutor LMS Pro – eLearning and online course solution: Insecure Direct Object ReferenceCVE-2025-6639 · affects up to 3.8.3 · reported by WordfenceMedium 5.4
• Oct 25, 2025Tutor LMS – eLearning and online course solution: Unauthorized modification of dataCVE-2025-11564 · affects up to 3.8.3 · reported by WordfenceMedium 5.3
• Sep 9, 2025Tutor LMS: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-58993 · affects up to 3.7.4 · reported by PatchstackHigh 7.6
• Aug 13, 2025Tutor LMS Pro – eLearning and online course solution: Time-based SQL InjectionCVE-2025-6184 · affects up to 3.7.0 · reported by WordfenceHigh 8.8
• Apr 10, 2025Tutor LMS: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)CVE-2025-32230 · affects up to 3.4.0 · reported by PatchstackMedium 4.3
• Nov 21, 2024Tutor LMS: SQL InjectionCVE-2024-10400 · affects up to 2.7.6 · reported by Wordfence83% oddsHigh 7.5
• Nov 21, 2024Tutor LMS: Bypass to user registrationCVE-2024-10393 · affects up to 2.7.6 · reported by WordfenceMedium 5.3
• Nov 1, 2024Tutor LMS: Missing AuthorizationCVE-2024-43142 · affects up to 2.7.3 · reported by PatchstackMedium 4.3
• Sep 10, 2024Tutor LMS: Cross-Site Request ForgeryCVE-2023-2919 · affects up to 2.7.4 · reported by WordfenceMedium 4.3
• Aug 26, 2024Tutor LMS: Cross-Site Request Forgery (CSRF)CVE-2024-39645 · affects up to 2.7.2 · reported by PatchstackMedium 5.4
• Aug 18, 2024Tutor LMS: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-43282 · affects up to 2.7.2 · reported by PatchstackHigh 7.6
• Aug 12, 2024Tutor LMS: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43231 · affects up to 2.7.3 · reported by PatchstackMedium 6.5
• Jul 20, 2024Tutor LMS: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-37947 · affects up to 2.7.2 · reported by PatchstackMedium 5.9
• Jul 9, 2024Tutor LMS: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-37266 · affects up to 2.7.1 · reported by PatchstackMedium 4.9
• Jul 9, 2024Tutor LMS: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-37256 · affects up to 2.7.1 · reported by PatchstackHigh 7.6
• Jun 11, 2024Tutor LMS: Missing AuthorizationCVE-2023-25799 · affects up to 2.1.8 · reported by PatchstackHigh 8.3
• Jun 7, 2024Tutor LMS – eLearning and online course solution: Insecure Direct Object ReferenceCVE-2024-5438 · affects up to 2.7.1 · reported by WordfenceMedium 4.3
• Jun 7, 2024Tutor LMS – eLearning and online course solution: Time-based SQL InjectionCVE-2024-4902 · affects up to 2.7.1 · reported by WordfenceHigh 7.2
• May 16, 2024Tutor LMS: Unauthorized access of data, modification of data, loss of dataCVE-2024-4223 · affects up to 2.7.0 · reported by WordfenceCritical 9.8
• May 16, 2024Tutor LMS: Time-based SQL InjectionCVE-2024-4318 · affects up to 2.7.0 · reported by WordfenceHigh 8.8
• May 16, 2024Tutor LMS – eLearning and online course solution: Insecure Direct Object Reference to Arbitrary Course DeletionCVE-2024-4279 · affects up to 2.7.0 · reported by WordfenceMedium 6.5
• May 2, 2024Tutor LMS – eLearning and online course solution: Unauthorized modification of dataCVE-2024-3553 · affects up to 2.6.2 · reported by WordfenceMedium 6.5
• Apr 25, 2024Tutor LMS – eLearning and online course solution: Stored Cross-Site ScriptingCVE-2024-3994 · affects up to 2.6.2 · reported by WordfenceMedium 5.4
• Mar 20, 2024Tutor LMS – eLearning and online course solution: Cross-Site Request ForgeryCVE-2024-1503 · affects up to 2.6.1 · reported by WordfenceMedium 4.3
• Mar 20, 2024Tutor LMS – eLearning and online course solution: Unauthorized loss of dataCVE-2024-1502 · affects up to 2.6.1 · reported by WordfenceMedium 5.4
• Mar 13, 2024Tutor LMS – eLearning and online course solution: Time-based SQL InjectionCVE-2024-1751 · affects up to 2.6.1 · reported by Wordfence3.1% oddsHigh 8.8
• Feb 28, 2024Tutor LMS – eLearning and online course solution: Unauthorized access of restricted Q&A contentCVE-2024-1133 · affects up to 2.6.0 · reported by WordfenceMedium 4.3
• Feb 28, 2024Tutor LMS – eLearning and online course solution: HTML InjectionCVE-2024-1128 · affects up to 2.6.0 · reported by WordfenceMedium 5.4
• Dec 15, 2023Tutor LMS – eLearning and online course solution: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-49829 · affects up to 2.2.4 · reported by PatchstackMedium 5.9
• Nov 3, 2023Tutor LMS: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-25990 · affects up to 2.1.10 · reported by PatchstackHigh 7.1
• Nov 3, 2023Tutor LMS: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-25800 · affects up to 2.2.0 · reported by PatchstackHigh 8.1
• Nov 3, 2023Tutor LMS: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-25700 · affects up to 2.1.10 · reported by PatchstackHigh 8.2
• Oct 16, 2023Tutor LMS: Does not sanitise and escape some of its settingsCVE-2023-4805 · fixed in 2.3.0 · reported by WPScanMedium 5.4
• Jul 4, 2023Tutor LMS: Does not implement adequate permission checks for REST API endpointsCVE-2023-3133 · fixed in 2.2.1 · reported by WPScanHigh 7.5
• Feb 6, 2023Tutor LMS: Does not sanitise and escape the reset_key and user_id parameters before outputting then back in attributesCVE-2023-0236 · fixed in 2.0.10 · reported by WPScan1.3% oddsMedium 6.1
• Oct 17, 2022Tutor LMS: Does not escape some course parametersCVE-2022-2563 · fixed in 2.0.10 · reported by WPScanMedium 4.8
• Jan 24, 2022Tutor LMS: Does not escape the search parameter before outputting it back in an attribute in an admin pageCVE-2021-25017 · fixed in 1.9.12 · reported by WPScan1.0% oddsMedium 6.1
• Nov 23, 2021Tutor LMS: Does not sanitise and escape user input before outputting back in attributes in the Student Registration pageCVE-2021-24873 · fixed in 1.9.11 · reported by WPScanMedium 6.1
• Oct 18, 2021Tutor LMS: Does not escape some of its settings before outputting them in attributesCVE-2021-24740 · fixed in 1.9.9 · reported by WPScanMedium 4.8
• Aug 2, 2021Tutor LMS – eLearning and online course solution: Did not escape the Summary field of Announcements (when outputting it in an attribute)CVE-2021-24455 · fixed in 1.9.2 · reported by WPScanMedium 5.4
• Apr 22, 2021Tutor LMS – eLearning and online course solution: Is affected by a local file inclusion vulnerability through the maliciously constructed sub_page parameter of the plugin's ToolsCVE-2021-24242 · fixed in 1.8.8 · reported by WPScanLow 3.8
• Apr 5, 2021Several AJAX endpoints in the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 were unprotected, allowing students to modify coursCVE-2021-24184 · fixed in 1.7.7 · reported by WPScan1.4% oddsHigh 8.8

Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.