+ 80 vulnerabilidades conocidas más
| CVE |
Vulnerabilidad |
Tipo |
Gravedad |
Afectadas |
Corregido en |
Publicado |
Estado |
|
CVE-2026-6965
|
Tutor LMS – eLearning and online course solution [tutor] < 3.9.10 |
Elusión de autorización mediante una clave controlada por el usuario |
Media
5,3
|
< 3.9.10
|
3.9.10 |
2026-05-12 |
—
|
|
CVE-2026-40743
|
Tutor LMS – eLearning and online course solution [tutor] < 3.9.8 |
Falta de control de autorización |
Media
6,5
|
< 3.9.8
|
3.9.8 |
2026-04-20 |
—
|
|
CVE-2026-6080
|
Tutor LMS – eLearning and online course solution [tutor] < 3.9.9 |
Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL) |
Media
6,5
|
< 3.9.9
|
3.9.9 |
2026-04-16 |
—
|
|
CVE-2026-5502
|
Tutor LMS – eLearning and online course solution [tutor] < 3.9.9 |
Falta de control de autorización |
Media
5,3
|
< 3.9.9
|
3.9.9 |
2026-04-16 |
—
|
|
CVE-2025-32223
|
Tutor LMS – eLearning and online course solution [tutor] < 3.9.5 |
Elusión de autorización mediante una clave controlada por el usuario |
Media
6,5
|
< 3.9.5
|
3.9.5 |
2026-03-16 |
—
|
|
CVE-2026-40740
|
Tutor LMS – eLearning and online course solution [tutor] < 3.9.8 |
— |
Media
5,4
|
< 3.9.8
|
3.9.8 |
2026-03-15 |
—
|
|
CVE-2025-13673
|
Tutor LMS – eLearning and online course solution [tutor] < 3.9.7 |
Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL) |
Alta
7,5
|
< 3.9.7
|
3.9.7 |
2026-02-27 |
—
|
|
CVE-2026-23799
|
Tutor LMS – eLearning and online course solution [tutor] < 3.9.6 |
Falta de control de autorización |
Media
6,5
|
< 3.9.6
|
3.9.6 |
2026-02-25 |
—
|
|
CVE-2025-13935
|
Tutor LMS – eLearning and online course solution [tutor] < 3.9.4 |
Falta de control de autorización |
Media
4,3
|
< 3.9.4
|
3.9.4 |
2026-01-08 |
—
|
|
CVE-2025-13934
|
Tutor LMS – eLearning and online course solution [tutor] < 3.9.4 |
Falta de control de autorización |
Media
4,3
|
< 3.9.4
|
3.9.4 |
2026-01-08 |
—
|
|
CVE-2025-13628
|
Tutor LMS – eLearning and online course solution [tutor] < 3.9.4 |
Falta de control de autorización |
Media
4,3
|
< 3.9.4
|
3.9.4 |
2026-01-08 |
—
|
|
CVE-2025-13679
|
Tutor LMS – eLearning and online course solution [tutor] < 3.9.4 |
Falta de control de autorización |
Media
6,5
|
< 3.9.4
|
3.9.4 |
2026-01-07 |
—
|
|
CVE-2025-47555
|
Tutor LMS – eLearning and online course solution [tutor] < 3.9.5 |
Elusión de autorización mediante una clave controlada por el usuario |
Baja
3,8
|
< 3.9.5
|
3.9.5 |
2026-01-02 |
—
|
|
CVE-2025-11564
|
Tutor LMS – eLearning and online course solution [tutor] < 3.9.0 |
Falta de control de autorización |
Media
5,3
|
< 3.9.0
|
3.9.0 |
2025-10-24 |
—
|
|
CVE-2025-58993
|
Tutor LMS – eLearning and online course solution [tutor] < 3.8.0 |
Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL) |
Alta
7,6
|
< 3.8.0
|
3.8.0 |
2025-09-09 |
—
|
|
CVE-2025-32230
|
Tutor LMS – eLearning and online course solution [tutor] < 3.4.1 |
Neutralización incorrecta de etiquetas HTML relacionadas con scripts en una página web (XSS básico) |
Media
4,3
|
< 3.4.1
|
3.4.1 |
2025-04-07 |
—
|
|
CVE-2024-10393
|
Tutor LMS – eLearning and online course solution [tutor] < 2.7.7 |
Control de acceso incorrecto |
Media
5,3
|
< 2.7.7
|
2.7.7 |
2024-11-20 |
—
|
|
CVE-2024-10400
|
Tutor LMS – eLearning and online course solution [tutor] < 2.7.7 |
Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL) |
Alta
7,5
|
< 2.7.7
|
2.7.7 |
2024-11-20 |
—
|
|
CVE-2023-2919
|
Tutor LMS – eLearning and online course solution [tutor] < 2.7.5 |
Falsificación de petición en sitios cruzados (CSRF) |
Media
4,3
|
< 2.7.5
|
2.7.5 |
2024-09-09 |
—
|
|
CVE-2024-43282
|
Tutor LMS – eLearning and online course solution [tutor] < 2.7.3 |
Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL) |
Alta
7,2
|
< 2.7.3
|
2.7.3 |
2024-08-16 |
—
|
|
CVE-2024-43231
|
Tutor LMS – eLearning and online course solution [tutor] < 2.7.4 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
5,4
|
< 2.7.4
|
2.7.4 |
2024-08-09 |
—
|
|
CVE-2024-43142
|
Tutor LMS – eLearning and online course solution [tutor] < 2.7.4 |
Falta de control de autorización |
Alta
8,8
|
< 2.7.4
|
2.7.4 |
2024-08-07 |
—
|
|
CVE-2024-39645
|
Tutor LMS – eLearning and online course solution [tutor] < 2.7.3 |
Falsificación de petición en sitios cruzados (CSRF) |
Alta
8,8
|
< 2.7.3
|
2.7.3 |
2024-08-01 |
—
|
|
CVE-2024-37947
|
Tutor LMS – eLearning and online course solution [tutor] < 2.7.3 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
4,8
|
< 2.7.3
|
2.7.3 |
2024-07-10 |
—
|
|
CVE-2024-37266
|
Tutor LMS – eLearning and online course solution [tutor] < 2.7.2 |
Limitación incorrecta de una ruta a un directorio restringido (Path Traversal) |
Alta
7,2
|
< 2.7.2
|
2.7.2 |
2024-06-27 |
—
|
|
CVE-2024-37256
|
Tutor LMS – eLearning and online course solution [tutor] < 2.7.2 |
Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL) |
Alta
7,2
|
< 2.7.2
|
2.7.2 |
2024-06-27 |
—
|
|
CVE-2024-4902
|
Tutor LMS – eLearning and online course solution [tutor] < 2.7.2 |
Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL) |
Alta
7,2
|
< 2.7.2
|
2.7.2 |
2024-06-06 |
—
|
|
CVE-2024-5438
|
Tutor LMS – eLearning and online course solution [tutor] < 2.7.2 |
Elusión de autorización mediante una clave controlada por el usuario |
Media
4,3
|
< 2.7.2
|
2.7.2 |
2024-06-06 |
—
|
|
CVE-2024-4279
|
Tutor LMS – eLearning and online course solution [tutor] < 2.7.1 |
Elusión de autorización mediante una clave controlada por el usuario |
Media
6,5
|
< 2.7.1
|
2.7.1 |
2024-05-15 |
—
|
|
CVE-2024-4318
|
Tutor LMS – eLearning and online course solution [tutor] < 2.7.1 |
Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL) |
Media
6,5
|
< 2.7.1
|
2.7.1 |
2024-05-15 |
—
|
|
CVE-2024-3553
|
Tutor LMS – eLearning and online course solution [tutor] < 2.7.0 |
Falta de control de autorización |
Media
6,5
|
< 2.7.0
|
2.7.0 |
2024-04-26 |
—
|
|
CVE-2024-3994
|
Tutor LMS – eLearning and online course solution [tutor] < 2.7.0 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
5,4
|
< 2.7.0
|
2.7.0 |
2024-04-24 |
—
|
|
CVE-2024-1503
|
Tutor LMS – eLearning and online course solution [tutor] < 2.6.2 |
Falsificación de petición en sitios cruzados (CSRF) |
Media
4,3
|
< 2.6.2
|
2.6.2 |
2024-03-12 |
—
|
|
CVE-2024-1502
|
Tutor LMS – eLearning and online course solution [tutor] < 2.6.2 |
Falta de control de autorización |
Media
4,3
|
< 2.6.2
|
2.6.2 |
2024-03-12 |
—
|
|
CVE-2024-1751
|
Tutor LMS – eLearning and online course solution [tutor] < 2.6.2 |
Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL) |
Alta
8,8
|
< 2.6.2
|
2.6.2 |
2024-03-11 |
—
|
|
CVE-2024-1133
|
Tutor LMS – eLearning and online course solution [tutor] < 2.6.1 |
Falta de control de autorización |
Media
4,3
|
< 2.6.1
|
2.6.1 |
2024-02-20 |
—
|
|
CVE-2024-1128
|
Tutor LMS – eLearning and online course solution [tutor] < 2.6.1 |
Neutralización incorrecta de elementos especiales en la salida usada por un componente posterior (inyección) |
Baja
3,5
|
< 2.6.1
|
2.6.1 |
2024-02-20 |
—
|
|
CVE-2023-49829
|
Tutor LMS – eLearning and online course solution [tutor] < 2.3.0 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
5,9
|
< 2.3.0
|
2.3.0 |
2023-12-05 |
—
|
|
CVE-2023-4805
|
Tutor LMS – eLearning and online course solution [tutor] < 2.3.0 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
5,4
|
< 2.3.0
|
2.3.0 |
2023-09-25 |
—
|
|
CVE-2023-3133
|
Tutor LMS – eLearning and online course solution [tutor] < 2.2.1 |
Elusión de autorización mediante una clave controlada por el usuario |
Alta
7,5
|
< 2.2.1
|
2.2.1 |
2023-06-12 |
—
|
|
CVE-2023-25990
|
Tutor LMS – eLearning and online course solution [tutor] < 2.2.0 |
Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL) |
Alta
7,1
|
< 2.2.0
|
2.2.0 |
2023-05-30 |
—
|
|
CVE-2023-25700
|
Tutor LMS – eLearning and online course solution [tutor] < 2.2.0 |
Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL) |
Alta
8,2
|
< 2.2.0
|
2.2.0 |
2023-05-30 |
—
|
|
CVE-2023-25800
|
Tutor LMS – eLearning and online course solution [tutor] < 2.2.1 |
Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL) |
Alta
8,1
|
< 2.2.1
|
2.2.1 |
2023-05-30 |
—
|
|
CVE-2023-25799
|
Tutor LMS – eLearning and online course solution [tutor] < 2.1.9 |
Falta de control de autorización |
Alta
8,3
|
< 2.1.9
|
2.1.9 |
2023-05-24 |
—
|
|
CVE-2023-0236
|
Tutor LMS – eLearning and online course solution [tutor] < 2.0.10 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
6,1
|
< 2.0.10
|
2.0.10 |
2023-01-12 |
—
|
|
—
|
Tutor LMS – eLearning and online course solution [tutor] < 1.9.13 |
— |
Desconocido
|
< 1.9.13
|
1.9.13 |
2023-01-10 |
—
|
|
CVE-2022-2563
|
Tutor LMS – eLearning and online course solution [tutor] < 2.0.10 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
4,8
|
< 2.0.10
|
2.0.10 |
2022-09-26 |
—
|
|
—
|
Tutor LMS – eLearning and online course solution [tutor] < 2.0.9 |
— |
Desconocido
|
< 2.0.9
|
2.0.9 |
2022-08-22 |
—
|
|
CVE-2021-25017
|
Tutor LMS – eLearning and online course solution [tutor] < 1.9.12 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
6,1
|
< 1.9.12
|
1.9.12 |
2021-12-27 |
—
|
|
—
|
Tutor LMS – eLearning and online course solution [tutor] < 1.9.12 |
— |
Desconocido
|
< 1.9.12
|
1.9.12 |
2021-12-27 |
—
|
|
—
|
Tutor LMS – eLearning and online course solution [tutor] < 1.9.12 |
— |
Desconocido
|
< 1.9.12
|
1.9.12 |
2021-12-27 |
—
|
|
CVE-2021-24873
|
Tutor LMS – eLearning and online course solution [tutor] < 1.9.11 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
6,1
|
< 1.9.11
|
1.9.11 |
2021-10-19 |
—
|
|
CVE-2021-24740
|
Tutor LMS – eLearning and online course solution [tutor] < 1.9.9 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
4,8
|
< 1.9.9
|
1.9.9 |
2021-09-20 |
—
|
|
—
|
Tutor LMS – eLearning and online course solution [tutor] < 1.9.6 |
— |
Desconocido
|
< 1.9.6
|
1.9.6 |
2021-08-09 |
—
|
|
—
|
Tutor LMS – eLearning and online course solution [tutor] < 1.9.6 |
— |
Desconocido
|
< 1.9.6
|
1.9.6 |
2021-08-09 |
—
|
|
CVE-2021-24455
|
Tutor LMS – eLearning and online course solution [tutor] < 1.9.2 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
5,4
|
< 1.9.2
|
1.9.2 |
2021-06-28 |
—
|
|
CVE-2021-24242
|
Tutor LMS – eLearning and online course solution [tutor] < 1.8.8 |
Limitación incorrecta de una ruta a un directorio restringido (Path Traversal) |
Baja
3,8
|
< 1.8.8
|
1.8.8 |
2021-04-05 |
—
|
|
CVE-2021-24181
|
Tutor LMS – eLearning and online course solution [tutor] < 1.7.7 |
Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL) |
Media
6,5
|
< 1.7.7
|
1.7.7 |
2021-03-15 |
—
|
|
CVE-2021-24183
|
Tutor LMS – eLearning and online course solution [tutor] < 1.8.3 |
Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL) |
Media
6,5
|
< 1.8.3
|
1.8.3 |
2021-03-15 |
—
|
|
CVE-2021-24184
|
Tutor LMS – eLearning and online course solution [tutor] < 1.7.7 |
Falta de control de autorización |
Alta
8,8
|
< 1.7.7
|
1.7.7 |
2021-03-15 |
—
|
|
CVE-2021-24185
|
Tutor LMS – eLearning and online course solution [tutor] < 1.7.7 |
Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL) |
Media
6,5
|
< 1.7.7
|
1.7.7 |
2021-03-15 |
—
|
|
CVE-2021-24182
|
Tutor LMS – eLearning and online course solution [tutor] < 1.8.3 |
Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL) |
Media
6,5
|
< 1.8.3
|
1.8.3 |
2021-03-15 |
—
|
|
CVE-2021-24186
|
Tutor LMS – eLearning and online course solution [tutor] < 1.8.3 |
Neutralización incorrecta de elementos especiales en un comando SQL (inyección SQL) |
Media
6,5
|
< 1.8.3
|
1.8.3 |
2021-03-15 |
—
|
|
—
|
Tutor LMS – eLearning and online course solution [tutor] < 1.7.7 |
— |
Desconocido
|
< 1.7.7
|
1.7.7 |
2021-03-15 |
—
|
|
—
|
Tutor LMS – eLearning and online course solution [tutor] < 1.8.3 |
— |
Desconocido
|
< 1.8.3
|
1.8.3 |
2021-03-15 |
—
|
|
—
|
Tutor LMS – eLearning and online course solution [tutor] < 1.7.7 |
— |
Desconocido
|
< 1.7.7
|
1.7.7 |
2021-03-15 |
—
|
|
—
|
Tutor LMS – eLearning and online course solution [tutor] < 1.9.13 |
— |
Desconocido
|
< 1.9.13
|
1.9.13 |
2021-01-10 |
—
|
|
CVE-2020-8615
|
Tutor LMS – eLearning and online course solution [tutor] < 1.5.3 |
Falsificación de petición en sitios cruzados (CSRF) |
Media
6,5
|
< 1.5.3
|
1.5.3 |
2020-02-04 |
—
|
|
—
|
Tutor LMS – eLearning and online course solution [tutor] < 1.5.3 |
— |
Desconocido
|
< 1.5.3
|
1.5.3 |
2020-02-04 |
—
|
|
CVE-2026-3360
|
Tutor LMS – eLearning and online course solution [tutor] < 3.9.8 |
— |
Desconocido
|
< 3.9.8
|
3.9.8 |
0000-00-00 |
—
|
|
CVE-2026-3358
|
Tutor LMS – eLearning and online course solution [tutor] < 3.9.8 |
— |
Desconocido
|
< 3.9.8
|
3.9.8 |
0000-00-00 |
—
|
|
CVE-2026-3371
|
Tutor LMS – eLearning and online course solution [tutor] < 3.9.8 |
— |
Media
4,3
|
< 3.9.8
|
3.9.8 |
0000-00-00 |
—
|
|
CVE-2026-1375
|
Tutor LMS – eLearning and online course solution [tutor] < 3.9.6 |
— |
Desconocido
|
< 3.9.6
|
3.9.6 |
0000-00-00 |
—
|
|
CVE-2026-1371
|
Tutor LMS – eLearning and online course solution [tutor] < 3.9.6 |
— |
Desconocido
|
< 3.9.6
|
3.9.6 |
0000-00-00 |
—
|
|
CVE-2026-0548
|
Tutor LMS – eLearning and online course solution [tutor] < 3.9.5 |
— |
Desconocido
|
< 3.9.5
|
3.9.5 |
0000-00-00 |
—
|
|
—
|
Tutor LMS – eLearning and online course solution [tutor] < 3.9.0 |
— |
Media
4,3
|
< 3.9.0
|
3.9.0 |
0000-00-00 |
—
|
|
—
|
Tutor LMS – eLearning and online course solution [tutor] < 1.9.13 |
— |
Desconocido
|
< 1.9.13
|
1.9.13 |
— |
—
|
|
—
|
Tutor LMS – eLearning and online course solution [tutor] < 1.9.12 |
— |
Desconocido
|
< 1.9.12
|
1.9.12 |
— |
—
|
|
—
|
Tutor LMS – eLearning and online course solution [tutor] < 1.9.6 |
— |
Desconocido
|
< 1.9.6
|
1.9.6 |
— |
—
|
|
—
|
Tutor LMS – eLearning and online course solution [tutor] < 1.9.11 |
— |
Desconocido
|
< 1.9.11
|
1.9.11 |
— |
—
|
CVE-2026-6965
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 3.9.9. This is due to the `get_course_id_by()` function unconditionally trusting the user-supplied `course` GET parameter as the authoritative course ID for content ownership lookups, which is then consumed by `can_user_manage()`, the plugin's sole authorization gate for instructor-level operations, causing it to evaluate instructor membership against the attacker-controlled course rather than the course that actually owns the target content object. This makes it possible for authenticated attackers, with instructor-level access and above, to perform unauthorized operations on any other instructor's course content, including permanently deleting lessons, assignments, quizzes (with cascading deletion of all student attempt data), topics, announcements, and Q&A threads, as well as creating or modifying lessons, topics, and announcements in victim courses, manipulating student quiz grades, and reading unpublished lesson and quiz content.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2026-40743
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 3.9.7. This makes it possible for unauthenticated attackers to perform an unauthorized action.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2026-6080
The Tutor LMS plugin for WordPress is vulnerable to SQL Injection in versions up to and including 3.9.8. This is due to insufficient escaping on the 'date' parameter combined with direct interpolation into a SQL fragment before being passed to $wpdb->prepare(). This makes it possible for authenticated attackers with Admin-level access and above to append additional SQL queries and extract sensitive information from the database.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2026-5502
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized course content manipulation in versions up to and including 3.9.8. This is due to a missing authorization check in the tutor_update_course_content_order() function. The function only validates the nonce (CSRF protection) but does not verify whether the user has permission to manage course content. The can_user_manage() authorization check only executes when the 'content_parent' parameter is present in the request. When this parameter is omitted, the function proceeds directly to save_course_content_order() which manipulates the wp_posts table without any authorization validation. This makes it possible for authenticated attackers with subscriber-level access and above to detach all lessons from any topic, move lessons between topics, and modify the menu_order of course content, effectively allowing them to disrupt the structure of any course on the site.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2025-32223
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.9.4 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform unauthorized actions.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2026-40740
The Tutor LMS plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 3.9.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2025-13673
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to SQL Injection via the 'coupon_code' parameter in all versions up to, and including, 3.9.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. NOTE: This vulnerability was partially mitigated in versions 3.9.4 and 3.9.6.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2026-23799
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 3.9.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2025-13935
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized course completion in all versions up to, and including, 3.9.2. This is due to missing enrollment verification in the 'mark_course_complete' function. This makes it possible for authenticated attackers, with subscriber level access and above, to mark any course as completed.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2025-13934
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized course enrollment in all versions up to, and including, 3.9.3. This is due to a missing capability check and purchasability validation in the `course_enrollment()` AJAX handler. This makes it possible for authenticated attackers, with subscriber level access and above, to enroll themselves in any course without going through the proper purchase flow.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2025-13628
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification and deletion of data due to a missing capability check on the 'bulk_action_handler' and 'coupon_permanent_delete' functions in all versions up to, and including, 3.9.3. This makes it possible for authenticated attackers, with subscriber level access and above, to delete, activate, deactivate, or trash arbitrary coupons.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2025-13679
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_order_by_id() function in all versions up to, and including, 3.9.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enumerate order IDs and exfiltrate sensitive data (PII), such as student name, email address, phone number, and billing address.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2025-47555
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.9.4 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Custom-level access and above, to perform an unauthorized action.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2025-11564
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check while verifying webhook signatures on the "verifyAndCreateOrderData" function
in all versions up to, and including, 3.8.3. This makes it possible for unauthenticated attackers to bypass payment verification and mark orders as paid by submitting forged webhook requests with `payment_type` set to 'recurring'.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2025-58993
The Tutor LMS plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 3.7.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2025-32230
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 3.4.0. This is due to the plugin not properly restricting HTML content from subscribers. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject HTML where they should not be authorized to.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2024-10393
The Tutor LMS plugin for WordPress is vulnerable to bypass to user registration in versions up to, and including, 2.7.6. This is due to a missing check for the 'users_can_register' option in the 'register_instructor' function. This makes it possible for unauthenticated attackers to register as the default role on the site, even if registration is disabled.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2024-10400
The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via the ‘rating_filter’ parameter in all versions up to, and including, 2.7.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2023-2919
The Tutor LMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.4. This is due to missing or incorrect nonce validation on the 'addon_enable_disable' function. This makes it possible for unauthenticated attackers to enable or disable addons via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2024-43282
The Tutor LMS plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.7.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2024-43231
The Tutor LMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with instructor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2024-43142
The Tutor LMS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the create_or_update_annoucement, tutor_quiz_save, tutor_load_edit_lesson_modal, and tutor_modal_create_or_update_lesson functions in versions up to, and including, 2.7.3. This makes it possible for authenticated attackers, with tutor instructor-level access and above, to modify data they should not have access to.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2024-39645
The Tutor LMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.2. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to delete course via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2024-37947
The Tutor LMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.7.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with tutor instructor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2024-37266
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.7.1. This makes it possible for authenticated attackers, with Administrator-level access and above, to perform actions on files outside of the originally intended directory.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2024-37256
<p>WordPress Tutor LMS Plugin <= 2.7.1 is vulnerable to SQL Injection</p><p>Software: Tutor LMS</p><p>Link: https://wordpress.org/plugins/tutor/#developers</p><p>Affected Version <= 2.7.1</p><p>Fixed in version 2.7.2 </p>
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2024-4902
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the ‘course_id’ parameter in all versions up to, and including, 2.7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with admin access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CVE-2024-37256 is likely a duplicate of this issue.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2024-5438
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.7.1 via the 'attempt_delete' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Instructor-level access and above, to delete arbitrary quiz attempts.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2024-4279
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference to Arbitrary Course Deletion in versions up to, and including, 2.7.0 via the 'tutor_course_delete' function due to missing validation on a user controlled key. This can allow authenticated attackers, with Instructor-level permissions and above, to delete any course.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2024-4318
The Tutor LMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘question_id’ parameter in versions up to, and including, 2.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Instructor-level permissions and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2024-3553
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the hide_notices function in all versions up to, and including, 2.6.2. This makes it possible for unauthenticated attackers to enable user registration on sites that may have it disabled.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2024-3994
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tutor_instructor_list' shortcode in all versions up to, and including, 2.6.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2024-1503
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.1. This is due to missing or incorrect nonce validation on the erase_tutor_data() function. This makes it possible for unauthenticated attackers to deactivate the plugin and erase all data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This requires the "Erase upon uninstallation" option to be enabled.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2024-1502
Update the WordPress Tutor LMS plugin to the latest available version (at least 2.6.2).
Lucio Sá discovered and reported this Broken Access Control vulnerability in WordPress Tutor LMS Plugin. A broken access control issue refers to a missing authorization, authentication or nonce token check in a function that could lead to an unprivileged user to executing a certain higher privileged action. This vulnerability has been fixed in version 2.6.2.
Have additional information or questions about this entry? Get in touch.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2024-1751
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the question_id parameter in all versions up to, and including, 2.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber/student access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2024-1133
Update the WordPress Tutor LMS plugin to the latest available version (at least 2.6.1).
drop discovered and reported this Broken Access Control vulnerability in WordPress Tutor LMS Plugin. A broken access control issue refers to a missing authorization, authentication or nonce token check in a function that could lead to an unprivileged user to executing a certain higher privileged action. This vulnerability has been fixed in version 2.6.1.
Have additional information or questions about this entry? Get in touch.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2024-1128
Update the WordPress Tutor LMS plugin to the latest available version (at least 2.6.1).
drop discovered and reported this Content Injection vulnerability in WordPress Tutor LMS Plugin. This could allow a malicious actor to inject their own content into pages and posts of your website. This could also be abused to inject phishing pages into your website. This vulnerability has been fixed in version 2.6.1.
Have additional information or questions about this entry? Get in touch.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2023-49829
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2023-4805
Update the WordPress Tutor LMS plugin to the latest available version (at least 2.3.0).
emad-fazel discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Tutor LMS Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 2.3.0.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2023-3133
The Tutor LMS plugin for WordPress is vulnerable to unauthorized access of data due to missing capability checks on various REST API endpoints in versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to view quiz questions and answers as well as student quiz attempts and author information such as email addresses.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2023-25990
The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via many parameters in versions up to, and including, 2.1.10 due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with tutor instructor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2023-25700
The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via many parameters in versions up to, and including, 2.1.10 due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2023-25800
The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via many parameters in versions up to, and including, 2.2.0 due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with student-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2023-25799
The Tutor LMS plugin for WordPress is vulnerable to unauthorized access, modification, or loss of data due to a missing capability check on the multiple functions in versions up to, and including, 2.1.8. This makes it possible for authenticated attackers, with student-level access and above, to perform actions such as deleting arbitrary posts.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2023-0236
The Tutor LMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'reset_key' and 'user_id' parameters (used by the password retrieval form) in versions up to, and including, 2.0.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
Tutor LMS – eLearning and online course solution [tutor] < 1.9.13
Update the WordPress Tutor LMS plugin to the latest available version (at least 1.9.13).
WPScanTeam discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Tutor LMS Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 1.9.13.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2022-2563
The Tutor LMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the topic name and lesson name parameters in versions up to, and including, 2.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
Tutor LMS – eLearning and online course solution [tutor] < 2.0.9
The Tutor LMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions 2.0.0-2.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2021-25017
The Tutor LMS WordPress plugin before 1.9.12 does not escape the search parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
Tutor LMS – eLearning and online course solution [tutor] < 1.9.12
Stored Cross-Site Scripting (XSS) vulnerability discovered by creadpag in WordPress Tutor LMS plugin (versions <= 1.9.11).
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
Tutor LMS – eLearning and online course solution [tutor] < 1.9.12
The Tutor LMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several user profile parameters in versions up to, and including, 1.9.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2021-24873
The Tutor LMS WordPress plugin before 1.9.11 does not sanitise and escape user input before outputting back in attributes in the Student Registration page, leading to a Reflected Cross-Site Scripting issue
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2021-24740
The Tutor LMS WordPress plugin before 1.9.9 does not escape some of its settings before outputting them in attributes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
Tutor LMS – eLearning and online course solution [tutor] < 1.9.6
Reflected Cross-Site Scripting (XSS) vulnerability discovered by WPScanTeam in WordPress Tutor LMS plugin (versions <= 1.9.5).
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
Tutor LMS – eLearning and online course solution [tutor] < 1.9.6
The Tutor LMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page’ parameter in versions up to, and including, 1.9.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2021-24455
The Tutor LMS – eLearning and online course solution WordPress plugin before 1.9.2 did not escape the Summary field of Announcements (when outputting it in an attribute), which can be created by users as low as Tutor Instructor. This lead to a Stored Cross-Site Scripting issue, which is triggered when viewing the Announcements list, and could result in privilege escalation when viewed by an admin.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2021-24242
The Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.8 is affected by a local file inclusion vulnerability through the maliciously constructed sub_page parameter of the plugin's Tools, allowing high privilege users to include any local php file
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2021-24181
The tutor_mark_answer_as_correct AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vulnerable to blind and time based SQL injections that could be exploited by students.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2021-24183
The tutor_quiz_builder_get_question_form AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2021-24184
Several AJAX endpoints in the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 were unprotected, allowing students to modify course information and elevate their privileges among many other actions.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2021-24185
The tutor_place_rating AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vulnerable to blind and time based SQL injections that could be exploited by students.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2021-24182
The tutor_quiz_builder_get_answers_by_question AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2021-24186
The tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
Tutor LMS – eLearning and online course solution [tutor] < 1.7.7
Multiple Blind/Time-based SQL Injection (SQLi) vulnerabilities were discovered by WordFence in the WordPress Tutor LMS plugin (versions <= 1.7.6).
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
Tutor LMS – eLearning and online course solution [tutor] < 1.8.3
Multiple Union SQL Injection (SQLi) vulnerabilities were discovered by WordFence in the WordPress Tutor LMS plugin (versions <= 1.8.2).
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
Tutor LMS – eLearning and online course solution [tutor] < 1.7.7
Unprotected AJAX Action to Privilege Escalation vulnerability discovered by WordFence in WordPress Tutor LMS plugin (versions <= 1.7.6).
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
Tutor LMS – eLearning and online course solution [tutor] < 1.9.13
The Tutor LMS plugin for WordPress is vulnerable to reflected Cross-Site Scripting in versions up to, and including 1.9.12 due to missing input and output sanitization of some user generated URLs.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2020-8615
A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and performing other malicious actions (such as blocking legitimate instructors).
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
Tutor LMS – eLearning and online course solution [tutor] < 1.5.3
Cross-Site Request Forgery (CSRF) vulnerability found by Jinson Varghese Behanan in WordPress Tutor LMS plugin (versions <= 1.5.2).
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
CVE-2026-3360
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to an Insecure Direct Object Reference in all versions up to, and including, 3.9.7. This is due to missing authentication and authorization checks in the `pay_incomplete_order()` function. The function accepts an attacker-controlled `order_id` parameter and uses it to look up order data, then writes billing fields to the order owner's profile (`$order_data->user_id`) without verifying the requester's identity or ownership. Because the Tutor nonce (`_tutor_nonce`) is exposed on public frontend pages, this makes it possible for unauthenticated attackers to overwrite the billing profile (name, email, phone, address) of any user who has an incomplete manual order, by sending a crafted POST request with a guessed or enumerated `order_id`.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2026-3358
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized private course enrollment in all versions up to, and including, 3.9.7. This is due to missing post_status validation in the `enroll_now()` and `course_enrollment()` functions. Both enrollment endpoints verify the nonce, user authentication, and whether the course is purchasable, but fail to check if the course has a `private` post_status. This makes it possible for authenticated attackers with Subscriber-level access or above to enroll in private courses by sending a crafted POST request with the target course ID. The enrollment record is created in the database and the private course title and enrollment status are exposed in the subscriber's dashboard, though WordPress core access control prevents the subscriber from viewing the actual course content (returns 404). Enrollment in private courses should be restricted to users with the `read_private_posts` capability.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2026-3371
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.9.7. This is due to missing authorization checks in the `save_course_content_order()` private method, which is called unconditionally by the `tutor_update_course_content_order` AJAX handler. While the handler's `content_parent` branch includes a `can_user_manage()` check, the `save_course_content_order()` call processes attacker-supplied `tutor_topics_lessons_sorting` JSON without any ownership or capability verification. This makes it possible for authenticated attackers with Subscriber-level access or above to detach lessons from topics, reorder course content, and reassign lessons between topics in any course, including admin-owned courses, by sending a crafted AJAX request with manipulated topic and lesson IDs.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2026-1375
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object References (IDOR) in all versions up to, and including, 3.9.5. This is due to missing object-level authorization checks in the `course_list_bulk_action()`, `bulk_delete_course()`, and `update_course_status()` functions. This makes it possible for authenticated attackers, with Tutor Instructor-level access and above, to modify or delete arbitrary courses they do not own by manipulating course IDs in bulk action requests.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2026-1371
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.5. This is due to missing authorization checks in the `ajax_coupon_details()` function, which only validates nonces but does not verify user capabilities. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive coupon information including coupon codes, discount amounts, usage statistics, and course/bundle applications.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2026-0548
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized attachment deletion due to a missing capability check on the `delete_existing_user_photo` function in all versions up to, and including, 3.9.4. This makes it possible for authenticated attackers, with subscriber level access and above, to delete arbitrary attachments on the site.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
Tutor LMS – eLearning and online course solution [tutor] < 3.9.0
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.8.3. This makes it possible for authenticated attackers, with tutor-level access and above, to view assignments for courses they don't teach which may contain sensitive information.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
Tutor LMS – eLearning and online course solution [tutor] < 1.9.13
El plugin no escapa algunas URL generadas antes de devolverlas en atributos, lo que conduce a Inyección de Código HTML Reflejado (XSS) [1].
Nota: La vulnerabilidad se identifica con el número CVE-... (no proporcionado en el texto original).
Traducción automática del texto original de la fuente.
Ver original
Fuente:
WPScan
Tutor LMS – eLearning and online course solution [tutor] < 1.9.12
The plugin does not escape the 'Job Title" field of user's profile, which could allow any authenticated users to set a Cross-Site Scripting payload in it, which will be triggered when an admin edit the related profile
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
WPScan
Tutor LMS – eLearning and online course solution [tutor] < 1.9.6
The plugin does not escape a page parameter before outputting it back in an student dashboard page, leading to a Reflected Cross-Site Scripting issue
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
WPScan
Tutor LMS – eLearning and online course solution [tutor] < 1.9.11
The plugin does not escape an URL before outputting it back in an attribute, leading to Reflected Cross-Site Scripting
The issue was initially fixed in 1.9.13 but re-introduced in 2.0.0
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
WPScan
Actualiza este plugin a la última versión de wordpress.org — cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en") cuando hay una registrada.
Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.