Is Tutor safe?

What this plugin does

• Slug: tutor
• Author: Themeum
• 100000+ active installs
• 88/100 rating (583 reviews on wordpress.org)
• 4291609 all-time downloads
• On WordPress.org since 2019-02-06

courseeducationelearninglearning management systemlms

Maintenance status

• Last updated: 2026-07-22 11:59am GMT
• Tested up to WordPress: 7.0.2
• Requires PHP: 7.4+

Known vulnerabilities

72 known CVEs on file for Tutor.

CVE-2026-15022

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via Stored Quiz Answer Array in all versions up to, and including, 4.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The payload is stored at quiz-attempt time via the wp_ajax_tutor_quiz_abandon handler, but the injected SQL executes only when a privileged user or Tutor REST API key holder requests the /wp-json/tutor/v1/quiz-attempt-details/{id} endpoint, making this a second-order (stored) injection chain.

Source: CVE.org

CVE-2026-12275

The Tutor LMS WordPress plugin before 3.9.13 does not, in its Droip and Kirki page-builder integration, perform the enrollment, purchase, and private-course capability checks it enforces in its core course handler, allowing authenticated users with subscriber-level access to enroll in paid or private courses without authorization, read private course content, and mark arbitrary courses as completed, on sites where the Droip or Kirki integration is active.

Source: CVE.org

CVE-2026-12274

The Tutor LMS WordPress plugin before 3.9.13 does not verify that the requesting user is allowed to edit a target post before overwriting it in one of its content-builder save handlers, authorizing the request only against an unrelated identifier, allowing authenticated users with instructor-level access to overwrite and take over any post or page on the site, including those owned by administrators.

Source: CVE.org

CVE-2026-12273

The Tutor LMS WordPress plugin before 3.9.13 does not perform any authorization or post-target validation before creating a comment in one of its handlers, and stores the comment pre-approved, allowing authenticated users with subscriber-level access and above to post auto-approved comments containing arbitrary HTML and links on any content across the site, bypassing the comment moderation queue.

Source: CVE.org

CVE-2026-12271

The Tutor LMS WordPress plugin before 3.9.13 does not verify ownership of the targeted quiz attempt before writing to it, allowing authenticated users with subscriber-level access and above to modify and force-complete other students' quiz attempts, overwriting their recorded marks and pass/fail result.

Source: CVE.org

CVE-2026-57694

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.9.13 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

Source: Wordfence

CVE-2026-13443

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Lesson Attachment Title in all versions up to, and including, 3.9.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Source: CVE.org

CVE-2026-10736

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to generic SQL Injection via the 'data' parameter in all versions up to, and including, 3.9.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Source: CVE.org

+ 80 more known vulnerabilities

CVE	Vulnerability	Type	Severity	Affected	Fixed in	Published	Status
CVE-2026-6965	Tutor LMS – eLearning and online course solution [tutor] < 3.9.10	Authorization Bypass Through User-Controlled Key	Medium 5.3	< 3.9.10	3.9.10	2026-05-12	—
CVE-2026-40743	Tutor LMS – eLearning and online course solution [tutor] < 3.9.8	Missing Authorization	Medium 6.5	< 3.9.8	3.9.8	2026-04-20	—
CVE-2026-6080	Tutor LMS – eLearning and online course solution [tutor] < 3.9.9	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')	Medium 6.5	< 3.9.9	3.9.9	2026-04-16	—
CVE-2026-5502	Tutor LMS – eLearning and online course solution [tutor] < 3.9.9	Missing Authorization	Medium 5.3	< 3.9.9	3.9.9	2026-04-16	—
CVE-2025-32223	Tutor LMS – eLearning and online course solution [tutor] < 3.9.5	Authorization Bypass Through User-Controlled Key	Medium 6.5	< 3.9.5	3.9.5	2026-03-16	—
CVE-2026-40740	Tutor LMS – eLearning and online course solution [tutor] < 3.9.8	—	Medium 5.4	< 3.9.8	3.9.8	2026-03-15	—
CVE-2025-13673	Tutor LMS – eLearning and online course solution [tutor] < 3.9.7	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')	High 7.5	< 3.9.7	3.9.7	2026-02-27	—
CVE-2026-23799	Tutor LMS – eLearning and online course solution [tutor] < 3.9.6	Missing Authorization	Medium 6.5	< 3.9.6	3.9.6	2026-02-25	—
CVE-2025-13935	Tutor LMS – eLearning and online course solution [tutor] < 3.9.4	Missing Authorization	Medium 4.3	< 3.9.4	3.9.4	2026-01-08	—
CVE-2025-13934	Tutor LMS – eLearning and online course solution [tutor] < 3.9.4	Missing Authorization	Medium 4.3	< 3.9.4	3.9.4	2026-01-08	—
CVE-2025-13628	Tutor LMS – eLearning and online course solution [tutor] < 3.9.4	Missing Authorization	Medium 4.3	< 3.9.4	3.9.4	2026-01-08	—
CVE-2025-13679	Tutor LMS – eLearning and online course solution [tutor] < 3.9.4	Missing Authorization	Medium 6.5	< 3.9.4	3.9.4	2026-01-07	—
CVE-2025-47555	Tutor LMS – eLearning and online course solution [tutor] < 3.9.5	Authorization Bypass Through User-Controlled Key	Low 3.8	< 3.9.5	3.9.5	2026-01-02	—
CVE-2025-11564	Tutor LMS – eLearning and online course solution [tutor] < 3.9.0	Missing Authorization	Medium 5.3	< 3.9.0	3.9.0	2025-10-24	—
CVE-2025-58993	Tutor LMS – eLearning and online course solution [tutor] < 3.8.0	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')	High 7.6	< 3.8.0	3.8.0	2025-09-09	—
CVE-2025-32230	Tutor LMS – eLearning and online course solution [tutor] < 3.4.1	Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)	Medium 4.3	< 3.4.1	3.4.1	2025-04-07	—
CVE-2024-10393	Tutor LMS – eLearning and online course solution [tutor] < 2.7.7	Improper Access Control	Medium 5.3	< 2.7.7	2.7.7	2024-11-20	—
CVE-2024-10400	Tutor LMS – eLearning and online course solution [tutor] < 2.7.7	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')	High 7.5	< 2.7.7	2.7.7	2024-11-20	—
CVE-2023-2919	Tutor LMS – eLearning and online course solution [tutor] < 2.7.5	Cross-Site Request Forgery (CSRF)	Medium 4.3	< 2.7.5	2.7.5	2024-09-09	—
CVE-2024-43282	Tutor LMS – eLearning and online course solution [tutor] < 2.7.3	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')	High 7.2	< 2.7.3	2.7.3	2024-08-16	—
CVE-2024-43231	Tutor LMS – eLearning and online course solution [tutor] < 2.7.4	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	Medium 5.4	< 2.7.4	2.7.4	2024-08-09	—
CVE-2024-43142	Tutor LMS – eLearning and online course solution [tutor] < 2.7.4	Missing Authorization	High 8.8	< 2.7.4	2.7.4	2024-08-07	—
CVE-2024-39645	Tutor LMS – eLearning and online course solution [tutor] < 2.7.3	Cross-Site Request Forgery (CSRF)	High 8.8	< 2.7.3	2.7.3	2024-08-01	—
CVE-2024-37947	Tutor LMS – eLearning and online course solution [tutor] < 2.7.3	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	Medium 4.8	< 2.7.3	2.7.3	2024-07-10	—
CVE-2024-37266	Tutor LMS – eLearning and online course solution [tutor] < 2.7.2	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')	High 7.2	< 2.7.2	2.7.2	2024-06-27	—
CVE-2024-37256	Tutor LMS – eLearning and online course solution [tutor] < 2.7.2	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')	High 7.2	< 2.7.2	2.7.2	2024-06-27	—
CVE-2024-4902	Tutor LMS – eLearning and online course solution [tutor] < 2.7.2	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')	High 7.2	< 2.7.2	2.7.2	2024-06-06	—
CVE-2024-5438	Tutor LMS – eLearning and online course solution [tutor] < 2.7.2	Authorization Bypass Through User-Controlled Key	Medium 4.3	< 2.7.2	2.7.2	2024-06-06	—
CVE-2024-4279	Tutor LMS – eLearning and online course solution [tutor] < 2.7.1	Authorization Bypass Through User-Controlled Key	Medium 6.5	< 2.7.1	2.7.1	2024-05-15	—
CVE-2024-4318	Tutor LMS – eLearning and online course solution [tutor] < 2.7.1	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')	Medium 6.5	< 2.7.1	2.7.1	2024-05-15	—
CVE-2024-3553	Tutor LMS – eLearning and online course solution [tutor] < 2.7.0	Missing Authorization	Medium 6.5	< 2.7.0	2.7.0	2024-04-26	—
CVE-2024-3994	Tutor LMS – eLearning and online course solution [tutor] < 2.7.0	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	Medium 5.4	< 2.7.0	2.7.0	2024-04-24	—
CVE-2024-1503	Tutor LMS – eLearning and online course solution [tutor] < 2.6.2	Cross-Site Request Forgery (CSRF)	Medium 4.3	< 2.6.2	2.6.2	2024-03-12	—
CVE-2024-1502	Tutor LMS – eLearning and online course solution [tutor] < 2.6.2	Missing Authorization	Medium 4.3	< 2.6.2	2.6.2	2024-03-12	—
CVE-2024-1751	Tutor LMS – eLearning and online course solution [tutor] < 2.6.2	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')	High 8.8	< 2.6.2	2.6.2	2024-03-11	—
CVE-2024-1133	Tutor LMS – eLearning and online course solution [tutor] < 2.6.1	Missing Authorization	Medium 4.3	< 2.6.1	2.6.1	2024-02-20	—
CVE-2024-1128	Tutor LMS – eLearning and online course solution [tutor] < 2.6.1	Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')	Low 3.5	< 2.6.1	2.6.1	2024-02-20	—
CVE-2023-49829	Tutor LMS – eLearning and online course solution [tutor] < 2.3.0	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	Medium 5.9	< 2.3.0	2.3.0	2023-12-05	—
CVE-2023-4805	Tutor LMS – eLearning and online course solution [tutor] < 2.3.0	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	Medium 5.4	< 2.3.0	2.3.0	2023-09-25	—
CVE-2023-3133	Tutor LMS – eLearning and online course solution [tutor] < 2.2.1	Authorization Bypass Through User-Controlled Key	High 7.5	< 2.2.1	2.2.1	2023-06-12	—
CVE-2023-25990	Tutor LMS – eLearning and online course solution [tutor] < 2.2.0	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')	High 7.1	< 2.2.0	2.2.0	2023-05-30	—
CVE-2023-25700	Tutor LMS – eLearning and online course solution [tutor] < 2.2.0	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')	High 8.2	< 2.2.0	2.2.0	2023-05-30	—
CVE-2023-25800	Tutor LMS – eLearning and online course solution [tutor] < 2.2.1	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')	High 8.1	< 2.2.1	2.2.1	2023-05-30	—
CVE-2023-25799	Tutor LMS – eLearning and online course solution [tutor] < 2.1.9	Missing Authorization	High 8.3	< 2.1.9	2.1.9	2023-05-24	—
CVE-2023-0236	Tutor LMS – eLearning and online course solution [tutor] < 2.0.10	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	Medium 6.1	< 2.0.10	2.0.10	2023-01-12	—
—	Tutor LMS – eLearning and online course solution [tutor] < 1.9.13	—	Unknown	< 1.9.13	1.9.13	2023-01-10	—
CVE-2022-2563	Tutor LMS – eLearning and online course solution [tutor] < 2.0.10	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	Medium 4.8	< 2.0.10	2.0.10	2022-09-26	—
—	Tutor LMS – eLearning and online course solution [tutor] < 2.0.9	—	Unknown	< 2.0.9	2.0.9	2022-08-22	—
CVE-2021-25017	Tutor LMS – eLearning and online course solution [tutor] < 1.9.12	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	Medium 6.1	< 1.9.12	1.9.12	2021-12-27	—
—	Tutor LMS – eLearning and online course solution [tutor] < 1.9.12	—	Unknown	< 1.9.12	1.9.12	2021-12-27	—
—	Tutor LMS – eLearning and online course solution [tutor] < 1.9.12	—	Unknown	< 1.9.12	1.9.12	2021-12-27	—
CVE-2021-24873	Tutor LMS – eLearning and online course solution [tutor] < 1.9.11	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	Medium 6.1	< 1.9.11	1.9.11	2021-10-19	—
CVE-2021-24740	Tutor LMS – eLearning and online course solution [tutor] < 1.9.9	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	Medium 4.8	< 1.9.9	1.9.9	2021-09-20	—
—	Tutor LMS – eLearning and online course solution [tutor] < 1.9.6	—	Unknown	< 1.9.6	1.9.6	2021-08-09	—
—	Tutor LMS – eLearning and online course solution [tutor] < 1.9.6	—	Unknown	< 1.9.6	1.9.6	2021-08-09	—
CVE-2021-24455	Tutor LMS – eLearning and online course solution [tutor] < 1.9.2	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	Medium 5.4	< 1.9.2	1.9.2	2021-06-28	—
CVE-2021-24242	Tutor LMS – eLearning and online course solution [tutor] < 1.8.8	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')	Low 3.8	< 1.8.8	1.8.8	2021-04-05	—
CVE-2021-24181	Tutor LMS – eLearning and online course solution [tutor] < 1.7.7	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')	Medium 6.5	< 1.7.7	1.7.7	2021-03-15	—
CVE-2021-24183	Tutor LMS – eLearning and online course solution [tutor] < 1.8.3	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')	Medium 6.5	< 1.8.3	1.8.3	2021-03-15	—
CVE-2021-24184	Tutor LMS – eLearning and online course solution [tutor] < 1.7.7	Missing Authorization	High 8.8	< 1.7.7	1.7.7	2021-03-15	—
CVE-2021-24185	Tutor LMS – eLearning and online course solution [tutor] < 1.7.7	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')	Medium 6.5	< 1.7.7	1.7.7	2021-03-15	—
CVE-2021-24182	Tutor LMS – eLearning and online course solution [tutor] < 1.8.3	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')	Medium 6.5	< 1.8.3	1.8.3	2021-03-15	—
CVE-2021-24186	Tutor LMS – eLearning and online course solution [tutor] < 1.8.3	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')	Medium 6.5	< 1.8.3	1.8.3	2021-03-15	—
—	Tutor LMS – eLearning and online course solution [tutor] < 1.7.7	—	Unknown	< 1.7.7	1.7.7	2021-03-15	—
—	Tutor LMS – eLearning and online course solution [tutor] < 1.8.3	—	Unknown	< 1.8.3	1.8.3	2021-03-15	—
—	Tutor LMS – eLearning and online course solution [tutor] < 1.7.7	—	Unknown	< 1.7.7	1.7.7	2021-03-15	—
—	Tutor LMS – eLearning and online course solution [tutor] < 1.9.13	—	Unknown	< 1.9.13	1.9.13	2021-01-10	—
CVE-2020-8615	Tutor LMS – eLearning and online course solution [tutor] < 1.5.3	Cross-Site Request Forgery (CSRF)	Medium 6.5	< 1.5.3	1.5.3	2020-02-04	—
—	Tutor LMS – eLearning and online course solution [tutor] < 1.5.3	—	Unknown	< 1.5.3	1.5.3	2020-02-04	—
CVE-2026-3360	Tutor LMS – eLearning and online course solution [tutor] < 3.9.8	—	Unknown	< 3.9.8	3.9.8	0000-00-00	—
CVE-2026-3358	Tutor LMS – eLearning and online course solution [tutor] < 3.9.8	—	Unknown	< 3.9.8	3.9.8	0000-00-00	—
CVE-2026-3371	Tutor LMS – eLearning and online course solution [tutor] < 3.9.8	—	Medium 4.3	< 3.9.8	3.9.8	0000-00-00	—
CVE-2026-1375	Tutor LMS – eLearning and online course solution [tutor] < 3.9.6	—	Unknown	< 3.9.6	3.9.6	0000-00-00	—
CVE-2026-1371	Tutor LMS – eLearning and online course solution [tutor] < 3.9.6	—	Unknown	< 3.9.6	3.9.6	0000-00-00	—
CVE-2026-0548	Tutor LMS – eLearning and online course solution [tutor] < 3.9.5	—	Unknown	< 3.9.5	3.9.5	0000-00-00	—
—	Tutor LMS – eLearning and online course solution [tutor] < 3.9.0	—	Medium 4.3	< 3.9.0	3.9.0	0000-00-00	—
—	Tutor LMS – eLearning and online course solution [tutor] < 1.9.13	—	Unknown	< 1.9.13	1.9.13	—	—
—	Tutor LMS – eLearning and online course solution [tutor] < 1.9.12	—	Unknown	< 1.9.12	1.9.12	—	—
—	Tutor LMS – eLearning and online course solution [tutor] < 1.9.6	—	Unknown	< 1.9.6	1.9.6	—	—
—	Tutor LMS – eLearning and online course solution [tutor] < 1.9.11	—	Unknown	< 1.9.11	1.9.11	—	—

CVE-2026-6965

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 3.9.9. This is due to the `get_course_id_by()` function unconditionally trusting the user-supplied `course` GET parameter as the authoritative course ID for content ownership lookups, which is then consumed by `can_user_manage()`, the plugin's sole authorization gate for instructor-level operations, causing it to evaluate instructor membership against the attacker-controlled course rather than the course that actually owns the target content object. This makes it possible for authenticated attackers, with instructor-level access and above, to perform unauthorized operations on any other instructor's course content, including permanently deleting lessons, assignments, quizzes (with cascading deletion of all student attempt data), topics, announcements, and Q&A threads, as well as creating or modifying lessons, topics, and announcements in victim courses, manipulating student quiz grades, and reading unpublished lesson and quiz content.

Source: CVE.org

CVE-2026-40743

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 3.9.7. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Source: Wordfence

CVE-2026-6080

The Tutor LMS plugin for WordPress is vulnerable to SQL Injection in versions up to and including 3.9.8. This is due to insufficient escaping on the 'date' parameter combined with direct interpolation into a SQL fragment before being passed to $wpdb->prepare(). This makes it possible for authenticated attackers with Admin-level access and above to append additional SQL queries and extract sensitive information from the database.

Source: CVE.org

CVE-2026-5502

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized course content manipulation in versions up to and including 3.9.8. This is due to a missing authorization check in the tutor_update_course_content_order() function. The function only validates the nonce (CSRF protection) but does not verify whether the user has permission to manage course content. The can_user_manage() authorization check only executes when the 'content_parent' parameter is present in the request. When this parameter is omitted, the function proceeds directly to save_course_content_order() which manipulates the wp_posts table without any authorization validation. This makes it possible for authenticated attackers with subscriber-level access and above to detach all lessons from any topic, move lessons between topics, and modify the menu_order of course content, effectively allowing them to disrupt the structure of any course on the site.

Source: CVE.org

CVE-2025-32223

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.9.4 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform unauthorized actions.

Source: Wordfence

CVE-2026-40740

The Tutor LMS plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 3.9.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

Source: Wordfence

CVE-2025-13673

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to SQL Injection via the 'coupon_code' parameter in all versions up to, and including, 3.9.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. NOTE: This vulnerability was partially mitigated in versions 3.9.4 and 3.9.6.

Source: CVE.org

CVE-2026-23799

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 3.9.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

Source: Wordfence

CVE-2025-13935

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized course completion in all versions up to, and including, 3.9.2. This is due to missing enrollment verification in the 'mark_course_complete' function. This makes it possible for authenticated attackers, with subscriber level access and above, to mark any course as completed.

Source: CVE.org

CVE-2025-13934

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized course enrollment in all versions up to, and including, 3.9.3. This is due to a missing capability check and purchasability validation in the `course_enrollment()` AJAX handler. This makes it possible for authenticated attackers, with subscriber level access and above, to enroll themselves in any course without going through the proper purchase flow.

Source: CVE.org

CVE-2025-13628

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification and deletion of data due to a missing capability check on the 'bulk_action_handler' and 'coupon_permanent_delete' functions in all versions up to, and including, 3.9.3. This makes it possible for authenticated attackers, with subscriber level access and above, to delete, activate, deactivate, or trash arbitrary coupons.

Source: CVE.org

CVE-2025-13679

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_order_by_id() function in all versions up to, and including, 3.9.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enumerate order IDs and exfiltrate sensitive data (PII), such as student name, email address, phone number, and billing address.

Source: CVE.org

CVE-2025-47555

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.9.4 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Custom-level access and above, to perform an unauthorized action.

Source: Wordfence

CVE-2025-11564

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check while verifying webhook signatures on the "verifyAndCreateOrderData" function in all versions up to, and including, 3.8.3. This makes it possible for unauthenticated attackers to bypass payment verification and mark orders as paid by submitting forged webhook requests with `payment_type` set to 'recurring'.

Source: CVE.org

CVE-2025-58993

The Tutor LMS plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 3.7.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Source: Wordfence

CVE-2025-32230

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 3.4.0. This is due to the plugin not properly restricting HTML content from subscribers. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject HTML where they should not be authorized to.

Source: Wordfence

CVE-2024-10393

The Tutor LMS plugin for WordPress is vulnerable to bypass to user registration in versions up to, and including, 2.7.6. This is due to a missing check for the 'users_can_register' option in the 'register_instructor' function. This makes it possible for unauthenticated attackers to register as the default role on the site, even if registration is disabled.

Source: CVE.org

CVE-2024-10400

The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via the ‘rating_filter’ parameter in all versions up to, and including, 2.7.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Source: CVE.org

CVE-2023-2919

The Tutor LMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.4. This is due to missing or incorrect nonce validation on the 'addon_enable_disable' function. This makes it possible for unauthenticated attackers to enable or disable addons via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Source: CVE.org

CVE-2024-43282

The Tutor LMS plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.7.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Source: Wordfence

CVE-2024-43231

The Tutor LMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with instructor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Source: Wordfence

CVE-2024-43142

The Tutor LMS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the create_or_update_annoucement, tutor_quiz_save, tutor_load_edit_lesson_modal, and tutor_modal_create_or_update_lesson functions in versions up to, and including, 2.7.3. This makes it possible for authenticated attackers, with tutor instructor-level access and above, to modify data they should not have access to.

Source: Wordfence

CVE-2024-39645

The Tutor LMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.7.2. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to delete course via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Source: Wordfence

CVE-2024-37947

The Tutor LMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.7.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with tutor instructor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Source: Wordfence

CVE-2024-37266

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.7.1. This makes it possible for authenticated attackers, with Administrator-level access and above, to perform actions on files outside of the originally intended directory.

Source: Wordfence

CVE-2024-37256

<p>WordPress Tutor LMS Plugin <= 2.7.1 is vulnerable to SQL Injection</p><p>Software: Tutor LMS</p><p>Link: https://wordpress.org/plugins/tutor/#developers</p><p>Affected Version <= 2.7.1</p><p>Fixed in version 2.7.2 </p>

Source: Patchstack

CVE-2024-4902

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the ‘course_id’ parameter in all versions up to, and including, 2.7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with admin access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. CVE-2024-37256 is likely a duplicate of this issue.

Source: Wordfence

CVE-2024-5438

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.7.1 via the 'attempt_delete' function due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Instructor-level access and above, to delete arbitrary quiz attempts.

Source: CVE.org

CVE-2024-4279

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference to Arbitrary Course Deletion in versions up to, and including, 2.7.0 via the 'tutor_course_delete' function due to missing validation on a user controlled key. This can allow authenticated attackers, with Instructor-level permissions and above, to delete any course.

Source: CVE.org

CVE-2024-4318

The Tutor LMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘question_id’ parameter in versions up to, and including, 2.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Instructor-level permissions and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Source: CVE.org

CVE-2024-3553

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the hide_notices function in all versions up to, and including, 2.6.2. This makes it possible for unauthenticated attackers to enable user registration on sites that may have it disabled.

Source: CVE.org

CVE-2024-3994

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tutor_instructor_list' shortcode in all versions up to, and including, 2.6.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Source: CVE.org

CVE-2024-1503

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.1. This is due to missing or incorrect nonce validation on the erase_tutor_data() function. This makes it possible for unauthenticated attackers to deactivate the plugin and erase all data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This requires the "Erase upon uninstallation" option to be enabled.

Source: CVE.org

CVE-2024-1502

Update the WordPress Tutor LMS plugin to the latest available version (at least 2.6.2). Lucio Sá discovered and reported this Broken Access Control vulnerability in WordPress Tutor LMS Plugin. A broken access control issue refers to a missing authorization, authentication or nonce token check in a function that could lead to an unprivileged user to executing a certain higher privileged action. This vulnerability has been fixed in version 2.6.2. Have additional information or questions about this entry? Get in touch.

Source: Patchstack

CVE-2024-1751

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the question_id parameter in all versions up to, and including, 2.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber/student access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Source: CVE.org

CVE-2024-1133

Update the WordPress Tutor LMS plugin to the latest available version (at least 2.6.1). drop discovered and reported this Broken Access Control vulnerability in WordPress Tutor LMS Plugin. A broken access control issue refers to a missing authorization, authentication or nonce token check in a function that could lead to an unprivileged user to executing a certain higher privileged action. This vulnerability has been fixed in version 2.6.1. Have additional information or questions about this entry? Get in touch.

Source: Patchstack

CVE-2024-1128

Update the WordPress Tutor LMS plugin to the latest available version (at least 2.6.1). drop discovered and reported this Content Injection vulnerability in WordPress Tutor LMS Plugin. This could allow a malicious actor to inject their own content into pages and posts of your website. This could also be abused to inject phishing pages into your website. This vulnerability has been fixed in version 2.6.1. Have additional information or questions about this entry? Get in touch.

Source: Patchstack

CVE-2023-49829

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Source: Wordfence

CVE-2023-4805

Update the WordPress Tutor LMS plugin to the latest available version (at least 2.3.0). emad-fazel discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Tutor LMS Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 2.3.0.

Source: Patchstack

CVE-2023-3133

The Tutor LMS plugin for WordPress is vulnerable to unauthorized access of data due to missing capability checks on various REST API endpoints in versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to view quiz questions and answers as well as student quiz attempts and author information such as email addresses.

Source: Wordfence

CVE-2023-25990

The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via many parameters in versions up to, and including, 2.1.10 due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with tutor instructor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Source: Wordfence

CVE-2023-25700

The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via many parameters in versions up to, and including, 2.1.10 due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Source: Wordfence

CVE-2023-25800

The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via many parameters in versions up to, and including, 2.2.0 due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with student-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Source: Wordfence

CVE-2023-25799

The Tutor LMS plugin for WordPress is vulnerable to unauthorized access, modification, or loss of data due to a missing capability check on the multiple functions in versions up to, and including, 2.1.8. This makes it possible for authenticated attackers, with student-level access and above, to perform actions such as deleting arbitrary posts.

Source: Wordfence

CVE-2023-0236

The Tutor LMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'reset_key' and 'user_id' parameters (used by the password retrieval form) in versions up to, and including, 2.0.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Source: Wordfence

Tutor LMS – eLearning and online course solution [tutor] < 1.9.13

Update the WordPress Tutor LMS plugin to the latest available version (at least 1.9.13). WPScanTeam discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Tutor LMS Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 1.9.13.

Source: Patchstack

CVE-2022-2563

The Tutor LMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the topic name and lesson name parameters in versions up to, and including, 2.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Source: Wordfence

Tutor LMS – eLearning and online course solution [tutor] < 2.0.9

The Tutor LMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions 2.0.0-2.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Source: Wordfence

CVE-2021-25017

The Tutor LMS WordPress plugin before 1.9.12 does not escape the search parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting

Source: CVE.org

Tutor LMS – eLearning and online course solution [tutor] < 1.9.12

Stored Cross-Site Scripting (XSS) vulnerability discovered by creadpag in WordPress Tutor LMS plugin (versions <= 1.9.11).

Source: Patchstack

Tutor LMS – eLearning and online course solution [tutor] < 1.9.12

The Tutor LMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several user profile parameters in versions up to, and including, 1.9.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Source: Wordfence

CVE-2021-24873

The Tutor LMS WordPress plugin before 1.9.11 does not sanitise and escape user input before outputting back in attributes in the Student Registration page, leading to a Reflected Cross-Site Scripting issue

Source: CVE.org

CVE-2021-24740

The Tutor LMS WordPress plugin before 1.9.9 does not escape some of its settings before outputting them in attributes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Source: CVE.org

Tutor LMS – eLearning and online course solution [tutor] < 1.9.6

Reflected Cross-Site Scripting (XSS) vulnerability discovered by WPScanTeam in WordPress Tutor LMS plugin (versions <= 1.9.5).

Source: Patchstack

Tutor LMS – eLearning and online course solution [tutor] < 1.9.6

The Tutor LMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page’ parameter in versions up to, and including, 1.9.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Source: Wordfence

CVE-2021-24455

The Tutor LMS – eLearning and online course solution WordPress plugin before 1.9.2 did not escape the Summary field of Announcements (when outputting it in an attribute), which can be created by users as low as Tutor Instructor. This lead to a Stored Cross-Site Scripting issue, which is triggered when viewing the Announcements list, and could result in privilege escalation when viewed by an admin.

Source: CVE.org

CVE-2021-24242

The Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.8 is affected by a local file inclusion vulnerability through the maliciously constructed sub_page parameter of the plugin's Tools, allowing high privilege users to include any local php file

Source: CVE.org

CVE-2021-24181

The tutor_mark_answer_as_correct AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vulnerable to blind and time based SQL injections that could be exploited by students.

Source: CVE.org

CVE-2021-24183

The tutor_quiz_builder_get_question_form AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students.

Source: CVE.org

CVE-2021-24184

Several AJAX endpoints in the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 were unprotected, allowing students to modify course information and elevate their privileges among many other actions.

Source: CVE.org

CVE-2021-24185

The tutor_place_rating AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vulnerable to blind and time based SQL injections that could be exploited by students.

Source: CVE.org

CVE-2021-24182

The tutor_quiz_builder_get_answers_by_question AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students.

Source: CVE.org

CVE-2021-24186

The tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL injection that could be exploited by students.

Source: CVE.org

Tutor LMS – eLearning and online course solution [tutor] < 1.7.7

Multiple Blind/Time-based SQL Injection (SQLi) vulnerabilities were discovered by WordFence in the WordPress Tutor LMS plugin (versions <= 1.7.6).

Source: Patchstack

Tutor LMS – eLearning and online course solution [tutor] < 1.8.3

Multiple Union SQL Injection (SQLi) vulnerabilities were discovered by WordFence in the WordPress Tutor LMS plugin (versions <= 1.8.2).

Source: Patchstack

Tutor LMS – eLearning and online course solution [tutor] < 1.7.7

Unprotected AJAX Action to Privilege Escalation vulnerability discovered by WordFence in WordPress Tutor LMS plugin (versions <= 1.7.6).

Source: Patchstack

Tutor LMS – eLearning and online course solution [tutor] < 1.9.13

The Tutor LMS plugin for WordPress is vulnerable to reflected Cross-Site Scripting in versions up to, and including 1.9.12 due to missing input and output sanitization of some user generated URLs.

Source: Wordfence

CVE-2020-8615

A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and performing other malicious actions (such as blocking legitimate instructors).

Source: CVE.org

Tutor LMS – eLearning and online course solution [tutor] < 1.5.3

Cross-Site Request Forgery (CSRF) vulnerability found by Jinson Varghese Behanan in WordPress Tutor LMS plugin (versions <= 1.5.2).

Source: Patchstack

CVE-2026-3360

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to an Insecure Direct Object Reference in all versions up to, and including, 3.9.7. This is due to missing authentication and authorization checks in the `pay_incomplete_order()` function. The function accepts an attacker-controlled `order_id` parameter and uses it to look up order data, then writes billing fields to the order owner's profile (`$order_data->user_id`) without verifying the requester's identity or ownership. Because the Tutor nonce (`_tutor_nonce`) is exposed on public frontend pages, this makes it possible for unauthenticated attackers to overwrite the billing profile (name, email, phone, address) of any user who has an incomplete manual order, by sending a crafted POST request with a guessed or enumerated `order_id`.

Source: Wordfence

CVE-2026-3358

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized private course enrollment in all versions up to, and including, 3.9.7. This is due to missing post_status validation in the `enroll_now()` and `course_enrollment()` functions. Both enrollment endpoints verify the nonce, user authentication, and whether the course is purchasable, but fail to check if the course has a `private` post_status. This makes it possible for authenticated attackers with Subscriber-level access or above to enroll in private courses by sending a crafted POST request with the target course ID. The enrollment record is created in the database and the private course title and enrollment status are exposed in the subscriber's dashboard, though WordPress core access control prevents the subscriber from viewing the actual course content (returns 404). Enrollment in private courses should be restricted to users with the `read_private_posts` capability.

Source: Wordfence

CVE-2026-3371

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.9.7. This is due to missing authorization checks in the `save_course_content_order()` private method, which is called unconditionally by the `tutor_update_course_content_order` AJAX handler. While the handler's `content_parent` branch includes a `can_user_manage()` check, the `save_course_content_order()` call processes attacker-supplied `tutor_topics_lessons_sorting` JSON without any ownership or capability verification. This makes it possible for authenticated attackers with Subscriber-level access or above to detach lessons from topics, reorder course content, and reassign lessons between topics in any course, including admin-owned courses, by sending a crafted AJAX request with manipulated topic and lesson IDs.

Source: Wordfence

CVE-2026-1375

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object References (IDOR) in all versions up to, and including, 3.9.5. This is due to missing object-level authorization checks in the `course_list_bulk_action()`, `bulk_delete_course()`, and `update_course_status()` functions. This makes it possible for authenticated attackers, with Tutor Instructor-level access and above, to modify or delete arbitrary courses they do not own by manipulating course IDs in bulk action requests.

Source: Wordfence

CVE-2026-1371

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.5. This is due to missing authorization checks in the `ajax_coupon_details()` function, which only validates nonces but does not verify user capabilities. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive coupon information including coupon codes, discount amounts, usage statistics, and course/bundle applications.

Source: Wordfence

CVE-2026-0548

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized attachment deletion due to a missing capability check on the `delete_existing_user_photo` function in all versions up to, and including, 3.9.4. This makes it possible for authenticated attackers, with subscriber level access and above, to delete arbitrary attachments on the site.

Source: Wordfence

Tutor LMS – eLearning and online course solution [tutor] < 3.9.0

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.8.3. This makes it possible for authenticated attackers, with tutor-level access and above, to view assignments for courses they don't teach which may contain sensitive information.

Source: CVE.org

Tutor LMS – eLearning and online course solution [tutor] < 1.9.13

The plugin does not escape some generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting

Source: WPScan

Tutor LMS – eLearning and online course solution [tutor] < 1.9.12

The plugin does not escape the 'Job Title" field of user's profile, which could allow any authenticated users to set a Cross-Site Scripting payload in it, which will be triggered when an admin edit the related profile

Source: WPScan

Tutor LMS – eLearning and online course solution [tutor] < 1.9.6

The plugin does not escape a page parameter before outputting it back in an student dashboard page, leading to a Reflected Cross-Site Scripting issue

Source: WPScan

Tutor LMS – eLearning and online course solution [tutor] < 1.9.11

The plugin does not escape an URL before outputting it back in an attribute, leading to Reflected Cross-Site Scripting The issue was initially fixed in 1.9.13 but re-introduced in 2.0.0

Source: WPScan

How to fix it

Update this plugin to the latest release from wordpress.org — each CVE above lists the exact release that fixed it ("Fixed in") when one is on file.

This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.

Safer / more established alternatives

• LearnPress – WordPress LMS Plugin for Create and Sell Online Courses — 70000+ active installs — 86/100 (594)
• Interactive Content – H5P — 40000+ active installs — 96/100 (61) — max PHP 8.4
• LearnPress – Course Review — 20000+ active installs — 50/100 (8) — max PHP 8.4
• Uncanny Toolkit for LearnDash — 20000+ active installs — 96/100 (105)
• Quiz Maker by AYS — 20000+ active installs — 98/100 (593)