Tutor LMS CVE-2026-100193

Exploitation is constrained to lesson pages whose nav-items array is empty, which the description states occurs when a lesson has no post content, no attachments, and comments are disabled or the viewer is not logged in; only under that state does the empty array bypass the in_array() validation on the 'tab' parameter and let the raw attacker value reach the output sink. Additional limiting factors are that the attack requires victim user interaction (clicking an attacker-supplied link, per UI:R) and is reflected rather than stored, so each victim must be individually lured; no authentication is required of the attacker (PR:N). These conditions make the realistic attack surface narrower than a typical always-on reflected XSS.

This is a genuinely moderate, not high-priority, issue and the CVSS base score of 4.7 (Medium) is a fair reflection of real-world risk. The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N shows a network-reachable, unauthenticated flaw (PR:N) but with two significant dampeners: high attack complexity (AC:H) and required user interaction (UI:R). The AC:H is well-justified by the description, which states exploitation only works when the targeted lesson page has an empty nav-items array - a non-default, situational state. No EPSS score was provided in the input, and there is no CISA KEV listing and no indication of public exploit code, so the exploitation status is: no public exploit identified at time of analysis. No SSVC decision data was supplied. The signals are internally consistent - a reflected XSS requiring a victim to click an attacker-supplied link against a specific page state is characteristically low-to-moderate risk, and all sources (reflected class, UI:R, AC:H, no KEV/EPSS/POC) agree. The only caveat is that the scope-change (S:C) and the broad WordPress deployment surface of the product modestly raise exposure. Overall this is a legitimate finding to patch on a normal cycle rather than an emergency.

An attacker crafts a URL to a Tutor LMS lesson page that has no content, no attachments, and comments disabled (or is viewed while logged out), appending a malicious script payload to the 'tab' parameter. The attacker distributes this link via phishing or a malicious post and tricks a victim into clicking it; because the empty nav-items state bypasses the in_array() tab validation, the raw payload is reflected into the page and executes in the victim's browser. No public exploit code was identified in the provided data.