EUVD-2026-40893
GHSA-78vh-g76h-gmfr
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Stored XSS requires a victim to load the injected page (UI:R); all other metrics align with the provided vector: low-privilege author account (PR:L), network delivery, scope change into victim browser (S:C), no availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Tutor LMS - eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Lesson Attachment Title in all versions up to, and including, 3.9.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in Tutor LMS (WordPress plugin by Themeum) versions through 3.9.13 allows authenticated attackers holding author-level or higher WordPress roles to inject persistent malicious scripts via the Lesson Attachment Title field. The injected payload is stored in the WordPress database and executes in the browser of any user who subsequently accesses a course page rendering the attachment - achieving a scope change from the plugin's context into the victim's browsing session. No public exploit code or CISA KEV listing has been identified at time of analysis, but the Wordfence disclosure includes direct source-code references to the vulnerable rendering path, lowering the barrier to exploitation.
Technical ContextAI
The vulnerability resides in the Tutor LMS plugin (CPE: cpe:2.3:a:themeum:tutor_lms_-_elearning_and_online_course_solution:*:*:*:*:*:*:*:*), a WordPress-based eLearning platform by Themeum. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS): user-supplied attachment title text is accepted without adequate sanitization in the data-entry path (Utils.php around lines L1688 and L1720) and is later rendered without proper output escaping in the template layer (templates/global/attachments.php at line L34). Because the unsanitized value persists in the WordPress database and is subsequently emitted verbatim into HTML, any attacker who can create or edit course lessons can plant a payload that fires on every future page load in any authenticated or unauthenticated visitor's browser. The CVSS S:C (scope-changed) metric reflects this cross-context execution: the attacker's payload escapes the plugin's own authorization boundary and runs in the victim's browser session.
RemediationAI
The primary fix is to update the Tutor LMS plugin beyond version 3.9.13 - a patch has been committed to the WordPress plugin SVN repository (changeset 3590029: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3590029%40tutor&new=3590029%40tutor), though the exact released version number containing this fix is not independently confirmed from the provided data. Site administrators should check the Tutor LMS changelog in the WordPress plugin directory and install the newest available version immediately. As a compensating control if immediate patching is not feasible, restrict the WordPress author role so that only fully trusted users can create or edit course lessons and attachments - this directly removes the attack surface by limiting who can supply the malicious title. A Web Application Firewall (WAF) rule targeting stored script injection in lesson attachment fields can also reduce risk, though WAF bypass is possible and should not substitute for patching. Sites that permit open course-author registration carry the highest risk and should prioritize the update or temporarily disable self-registration until the patch is applied.
Remote code execution is achievable in Tutor LMS WordPress plugin (≤4.0.7) via a PHP Object Injection flaw in the withdr
Unauthenticated attackers can overwrite billing profile data (name, email, phone, address) for any WordPress user with a
Unauthenticated remote PHP function invocation in the Tutor LMS WordPress plugin (all versions up to and including 4.0.5
We need to produce a JSON object with specific fields. Let's analyze the CVE data. First: product_name: "1-3 words ONLY
SQL injection in Tutor LMS plugin for WordPress through version 3.9.8 allows authenticated Admin-level attackers to extr
Tutor LMS plugin for WordPress up to version 3.9.7 allows authenticated subscribers to enroll in private courses due to
Authenticated instructors in Tutor LMS versions up to 3.9.9 can manipulate course ownership logic via an attacker-contro
Tutor LMS plugin for WordPress versions up to 3.9.8 allow authenticated attackers to manipulate course content structure
SQL injection in Tutor LMS (WordPress plugin by Themeum) exposes the underlying database to read-access by any authentic
Administrator-level SQL injection in the Tutor LMS plugin for WordPress versions ≤4.0.1 permits extraction of sensitive
Insecure Direct Object Reference in Tutor LMS WordPress plugin versions up to 3.9.7 allows authenticated Subscriber-leve
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today