Tutor LMS CVE-2026-88963

Exploitation requires the attacker to supply a crafted 'redirect_url' query parameter whose value is processed by the Topbar component's back-button handler and written into the DOM without sufficient validation (vulnerable in Tutor LMS ≤4.0.8, patched in 4.0.9). The decisive limiting factor is required user interaction (UI:R): a victim must load the attacker-supplied URL and trigger the back-button handler for the payload to execute, so this cannot be exploited silently against passive servers. No authentication is required (PR:N), and default configurations of the plugin are affected; impact is confined to script execution in the victim's browser session, not server-side access.

This is a moderate-severity client-side vulnerability, not a top-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 6.1) is consistent with a typical reflected/DOM-based XSS: network-reachable and unauthenticated, but requiring victim interaction (UI:R) and yielding only limited confidentiality and integrity impact with a scope change into the victim's browser context. No EPSS score was provided, there is no CISA KEV listing, and no public proof-of-concept is referenced - so exploitation status is 'no public exploit identified at time of analysis'. There is no SSVC decision data supplied. The signals are internally consistent (nothing contradicts the CVSS vector), so this reads as a genuine-but-ordinary WordPress plugin XSS rather than a high-urgency flaw: real enough to patch promptly, but gated by user interaction and limited to script execution in a victim browser rather than server compromise. Note: EPSS, KEV, POC and SSVC inputs are all absent from the data, so real-world exploitation likelihood is inferred from the vulnerability class alone, not measured.

An unauthenticated attacker crafts a URL to a Tutor LMS page (e.g., an order/topbar view) with a malicious 'redirect_url' parameter containing a script payload, then lures a logged-in user or visitor to click it. When the victim's browser processes the Topbar back-button handler, the unsanitized value is written into the DOM and the injected script executes in the victim's session context. No public exploit code is referenced, but the vulnerable client-side handler is identified in the patched file tutor-order-details.js.