Tutor LMS <= 2.7.6 - SQL Injection

The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via the ‘ratingfilter’ parameter in all versions up to, and including, 2.7.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

WordPress Tutor LMS <2.0.10 - Cross Site Scripting

WordPress Tutor LMS plugin before 2.0.10 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape the resetkey and userid parameters before outputting then back in attributes. An attacker can inject arbitrary script in the browser of an unsuspecting user in the conte...

Tutor LMS <= 2.1.10 - SQL Injection

Tutor LMS – eLearning and online course solution plugin for WordPress all versions up to 2.6.1 contains a time-based SQL Injection caused by insufficient escaping on the questionid parameter in SQL queries, letting authenticated attackers with subscriber or higher access extract sensitive...

Wordpress Plugin Tutor LMS 1.5.3 - Cross-Site Request Forgery

A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and performing other malicious actions such as blocking legitimate instructors. id: CVE-2020-8615 info: name: Wordpress Plugin Tutor LMS 1.5.3 - Cross-Site Reque...

CVE-2025-13673

CVE-2025-13673 — Tutor LMS SQLインジェクションラボ WordPressプラグインTutor LMS = 3.9.6 における、couponcodeパラメータ経由の未認証SQLインジェクション クイックスタート root@kitploit: 1. Clone and start the lab git clone https://github.com/dinosn/CVE-2025-13673.git cd CVE-2025-13673 ./setup.sh Deploys WordPress + Tutor LMS 3.9.3 2. Run the...

CVE-2024-3553

CVE-2024-3553 Tutor LMS = 2.6.2 - 未認証による制限付きオプション更新に対する認可の欠如 Tutor LMS – WordPress用のeラーニングおよびオンラインコースソリューションプラグインは、バージョン2.6.2までのすべてのバージョンにおいて、hidenotices関数に対する能力チェックの欠如により、データの不正な変更に対して脆弱です。これにより、認証された攻撃者（購読者などの低権限ユーザーを含む）が、管理者によって無効にされている可能性のあるサイトでユーザー登録を有効にすることが可能になります。 詳細 タイプ : プラグイン スラッグ :...

CVE-2025-65681

CVE-2025-65681 Overhang.IO tutor-open-edx overhangio/tutor 20.0.2 中发现了一个问题，由于缺少适当的 cache-control HTTP 标头和客户端会话检查，本地未授权攻击者能够获取敏感信息。发现者 - Rivek Raj Tamang RivuDon，印度锡金。 受影响产品：Overhang.IO 受影响版本：20.0.2 发现者：Rivek Raj Tamang RivuDon，印度锡金 漏洞详情 信息泄露 摘要 该漏洞允许未授权访问 Overhang.IO Tutor tutor-open-edx 20.0.2...

CVE-2026-1375

CVE-2026-1375: Tutor LMS प्लगइन में प्रमाणित IDOR / टूटा एक्सेस नियंत्रण अस्वीकरण: यह रिपॉजिटरी केवल शैक्षिक उद्देश्यों और नैतिक प्रकटीकरण के लिए बनाई गई है। यह भेद्यता विक्रेता को जिम्मेदारीपूर्वक सूचित कर दी गई है और इसे पैच कर दिया गया है। उचित प्राधिकरण के बिना सिस्टम का शोषण करने के लिए इस...

WordPress Tutor LMS plugin <= 4.0.5 - Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters vulnerability

Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters vulnerability discovered by Slopothecary in WordPress Plugin Tutor LMS versions = 4.0.5...

CVE-2026-16759

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument function invocation in all versions up to, and including, 4.0.5 via the tutorcoursefilterajax AJAX action. This is due to missing authorization on the handler...

CVE-2026-16759 Tutor LMS <= 4.0.5 - Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument function invocation in all versions up to, and including, 4.0.5 via the tutorcoursefilterajax AJAX action. This is due to missing authorization on the handler...

CVE-2026-16759

Tutor LMS (eLearning plugin for WordPress, versions ≤ 4.0.5 ) is vulnerable to unauthenticated Remote Code Execution limited to zero-argument function invocation via the tutor_course_filter_ajax AJAX action. The root cause is a missing authorization check combined with unsanitized array keys pass...

EUVD-2026-67406

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument function invocation in all versions up to, and including, 4.0.5 via the tutorcoursefilterajax AJAX action. This is due to missing authorization on the handler...

VulnCheck KEV: CVE-2026-16759

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument function invocation in all versions up to, and including, 4.0.5 via the tutorcoursefilterajax AJAX action. This is due to missing authorization on the handler...

CVE-2026-19092

The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output...

CVE-2026-19092 Tutor LMS < 4.0.6 - Unauthenticated Arbitrary Zero-Argument Function Invocation via Template Variable Shadowing

The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output...

CVE-2026-19092

The Tutor LMS WordPress plugin before 4.0.6 is vulnerable to template variable shadowing : request data can overwrite internal variables during template rendering, allowing unauthenticated users to invoke arbitrary zero-argument PHP functions and receive their output. This yields a CVSS 3.1 score...

CVE-2024-10400

CVE-2024-10400 Il plugin Tutor LMS per WordPress è vulnerabile a SQL Injection tramite il parametro 'ratingfilter' in tutte le versioni fino alla 2.7.6 inclusa versioni Nota : Lo sfruttamento utilizza un controllo di SQL injection cieca basata sul tempo con una soglia di ritardo di 5 secondi. Se ...

RWST

RWST Strumenti Ragno Vedova Rossa App Termux AD...

WordPress Tutor LMS plugin 4.0.0-4.0.6 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by Jakub Herman in WordPress Plugin Tutor LMS versions 4.0.6...