CVE-2026-88963

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via the 'redirecturl' parameter in versions up to, and including, 4.0.8 This is due to insufficient input validation in the Topbar component's back button handler. This makes ...

CVE-2026-88963 Tutor LMS <= 4.0.8 - Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting via 'redirect_url' Parameter

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via the 'redirecturl' parameter in versions up to, and including, 4.0.8 This is due to insufficient input validation in the Topbar component's back button handler. This makes ...

CVE-2026-88963

The Tutor LMS plugin for WordPress (versions up to and including 4.0.8 ) is vulnerable to DOM-Based Cross-Site Scripting (XSS) . The root cause is insufficient input validation within the Topbar component's back button handler specifically involving the 'redirect_url' parameter. This flaw allows ...

PT-2026-115460

Name of the Vulnerable Software and Affected Versions Tutor LMS – eLearning and online course solution plugin for WordPress versions prior to 4.0.9 Description Insufficient input validation in the Topbar component's back button handler allows unauthenticated attackers to perform DOM-Based...