68 matches found
CVE-2026-88963
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via the 'redirecturl' parameter in versions up to, and including, 4.0.8 This is due to insufficient input validation in the Topbar component's back button handler. This makes ...
CVE-2026-88963
The Tutor LMS plugin for WordPress (versions up to and including 4.0.8 ) is vulnerable to DOM-Based Cross-Site Scripting (XSS) . The root cause is insufficient input validation within the Topbar component's back button handler specifically involving the 'redirect_url' parameter. This flaw allows ...
CVE-2026-88963 Tutor LMS <= 4.0.8 - Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting via 'redirect_url' Parameter
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via the 'redirecturl' parameter in versions up to, and including, 4.0.8 This is due to insufficient input validation in the Topbar component's back button handler. This makes ...
CVE-2026-88963 Tutor LMS <= 4.0.8 - Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting via 'redirect_url' Parameter
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via the 'redirecturl' parameter in versions up to, and including, 4.0.8 This is due to insufficient input validation in the Topbar component's back button handler. This makes ...
EUVD-2026-102681
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via the 'redirecturl' parameter in versions up to, and including, 4.0.8 This is due to insufficient input validation in the Topbar component's back button handler. This makes ...
PT-2026-115460
Name of the Vulnerable Software and Affected Versions Tutor LMS – eLearning and online course solution plugin for WordPress versions prior to 4.0.9 Description Insufficient input validation in the Topbar component's back button handler allows unauthenticated attackers to perform DOM-Based...
CVE-2026-88963: Improper Neutralization of Input During Web Page Generation
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via the 'redirecturl' parameter in versions up to, and including, 4.0.8 This is due to insufficient input validation in the Topbar component's back button handler. This makes ...
WordPress Tutor LMS Cross-site Scripting Vulnerability
WordPress Tutor LMS versions 4.0.8 and earlier have a cross-site scripting vulnerability. This vulnerability stems from insufficient input validation of the redirecturl parameter in the Topbar component’s return handler, making it susceptible to DOM-based cross-site scripting attacks...
WordPress TopBar plugin cross-site request forgery vulnerability
WordPress TopBar plugin is a plugin for adding a notification bar at the top of your website, mainly used to display messages, links or promotional content to help users attract attention and increase conversions. The WordPress TopBar plugin suffers from a cross-site request forgery vulnerability...
CVE-2025-10300
The TopBar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on the fmenbtopbarsavesettings function. This makes it possible for unauthenticated attackers to update the plugin's settin...
CVE-2025-10300 TopBar <= 1.0.0 - Cross-Site Request Forgery to Settings Update
The TopBar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on the fmenbtopbarsavesettings function. This makes it possible for unauthenticated attackers to update the plugin's settin...
EUVD-2025-34551
The TopBar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on the fmenbtopbarsavesettings function. This makes it possible for unauthenticated attackers to update the plugin's settin...
CVE-2025-10300 TopBar <= 1.0.0 - Cross-Site Request Forgery to Settings Update
The TopBar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on the fmenbtopbarsavesettings function. This makes it possible for unauthenticated attackers to update the plugin's settin...
WordPress TopBar plugin <= 1.0.0 - Cross-Site Request Forgery to Settings Update vulnerability
Cross-Site Request Forgery to Settings Update vulnerability discovered by jsonc in WordPress Plugin TopBar versions = 1.0.0...
PT-2025-42293
Name of the Vulnerable Software and Affected Versions WordPress TopBar plugin versions prior to 1.0.1 Description The TopBar plugin for WordPress is susceptible to Cross-Site Request Forgery due to inadequate nonce validation within the fme nb topbar save settings function. This allows attackers ...
CVE-2025-10300: Cross-Site Request Forgery (CSRF)
The TopBar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on the fmenbtopbarsavesettings function. This makes it possible for unauthenticated attackers to update the plugin's settin...
EUVD-2024-45689
Malicious code in bioql PyPI...
EUVD-2025-29087
Malicious code in bioql PyPI...