Tutor LMS EUVD-2026-96440

Exploitation requires a victim with an active browser session to interact with attacker-supplied content - i.e. click a crafted link to, or load, a vulnerable Tutor LMS page (UI:R), on a WordPress site running the Tutor LMS plugin at version 4.1.0 or earlier. No authentication is required of the attacker (PR:N), but the practical limiting factors are the need for user interaction and the value of the targeted victim's session (impact is greatest when the lured victim is an administrator or instructor). Impact is confined to the browser/session context (Low C/I/A), not direct server code execution. The specific vulnerable parameter, page, and whether the input is reflected or stored are not specified in the provided data.

The signals here are moderate and internally consistent rather than alarming. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L = 7.1 High) describes a network-reachable, low-complexity, unauthenticated (PR:N) Cross-Site Scripting flaw that requires user interaction (UI:R) and causes a scope change (S:C) with only Low impact to confidentiality, integrity, and availability - a profile characteristic of a browser-executed XSS rather than a server compromise. No EPSS score was supplied, so exploitation probability cannot be quantified from the input. The vulnerability is NOT in CISA KEV and no public exploit code was provided in the sources, so this is 'no public exploit identified at time of analysis.' Patchstack is a credible source for WordPress-plugin vulnerabilities, which raises confidence in the finding itself, but the absence of KEV, EPSS, and a POC means there is no evidence of active or widespread exploitation. Net assessment: a legitimate High-severity XSS worth patching promptly on affected sites, but not an emergency priority on the available evidence - the Low impact metrics and the UI:R requirement cap real-world severity below what the 7.1 headline might suggest.

An unauthenticated attacker crafts a malicious URL or input that reflects/stores attacker-controlled script into a page served by the Tutor LMS plugin (<= 4.1.0). When a victim - potentially an administrator or logged-in instructor/student - visits the crafted link or page, the script executes in their browser session (UI:R), enabling session/cookie theft, actions on behalf of the victim, or defacement. No public proof-of-concept was identified in the provided sources.