Tutor LMS CVE-2026-111407

Exploitation requires an authenticated account with at least low privileges on the target WordPress site (PR:L) - typically a role granted by Tutor LMS such as instructor or student that can submit content stored by the plugin - plus victim interaction (UI:R): another user, ideally an administrator, must load the page where the unsanitized input is rendered for the stored script to execute. This is not exploitable by a fully unauthenticated, no-interaction attacker, and sites that restrict account self-registration or the roles able to submit stored content substantially reduce exposure. The exact input field is not named in the available data, so the precise feature that must be reachable should be confirmed against the Patchstack entry and vendor code.

This is a moderate-severity Stored XSS (CWE-79) in the Themeum Tutor LMS WordPress plugin (through 4.1.2), rated CVSS 6.5 with vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L. The signals align toward a real-but-not-urgent issue rather than a top-priority emergency: the network attack vector and low complexity ease exploitation, but PR:L means the attacker must already hold an authenticated, low-privilege account (e.g. an instructor/contributor role within the LMS), and UI:R means a victim must view the poisoned page for the payload to fire. The scope change (S:C) is the aggravating factor - stored script executes in the browser of other users, potentially a higher-privileged administrator, which is how such plugin XSS flaws are typically escalated toward account takeover. No EPSS score, CISA KEV listing, SSVC decision, or proof-of-concept is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the only source is the Patchstack database entry. The CVSS vector and the 'Stored XSS' description are mutually consistent (authenticated injection + victim interaction), so there is no signal conflict to flag - the main limiter on real-world risk is the dual requirement of a pre-existing low-privilege account and victim interaction.

An attacker who holds a low-privilege authenticated account on a WordPress site running Tutor LMS (for example an instructor or student role) submits input through a plugin field that is stored without proper neutralization. When an administrator or another user later views the page rendering that stored data, the injected JavaScript executes in their browser session, enabling session/cookie theft or actions performed as the victim. No public proof-of-concept is available, but the low attack complexity makes exploitation straightforward once an account is obtained.