EUVD-2026-94960

Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in Themeum Tutor LMS tutor allows Leveraging Race Conditions.This issue affects Tutor LMS: from n/a through 4.1.1...

WordPress Tutor LMS plugin <= 4.1.1 - Race Condition vulnerability

Race Condition vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Tutor LMS versions = 4.1.2...

CVE-2024-3553

CVE-2024-3553 Tutor LMS = 2.6.2 - Missing Authorization to Unauthenticated Limited Options Update The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the hidenotices function in all...

WordPress Tutor LMS plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin Tutor LMS versions = 4.1.0...

CVE-2026-18439

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.0.7 via the tutorquizbuildersave AJAX action due to missing validation that nested questionid, answerid, deletedquestionids, and...

CVE-2026-18439 Tutor LMS <= 4.0.7 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via 'payload' Parameter

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.0.7 via the tutorquizbuildersave AJAX action due to missing validation that nested questionid, answerid, deletedquestionids, and...

CVE-2026-18439

The Tutor LMS WordPress plugin (versions up to and including 4.0.7 ) is vulnerable to an Insecure Direct Object Reference (IDOR) via the tutor_quiz_builder_save AJAX action. The root cause is a lack of validation for nested identifiers—specifically question_id, answer_id, deleted_question_ids[], ...

EUVD-2026-84301

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.0.7 via the tutorquizbuildersave AJAX action due to missing validation that nested questionid, answerid, deletedquestionids, and...

CVE-2026-18439 Tutor LMS <= 4.0.7 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via 'payload' Parameter

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.0.7 via the tutorquizbuildersave AJAX action due to missing validation that nested questionid, answerid, deletedquestionids, and...

PT-2026-96663

Name of the Vulnerable Software and Affected Versions Tutor LMS – eLearning and online course solution plugin for WordPress versions prior to 4.0.8 Description An Insecure Direct Object Reference IDOR exists via the tutor quiz builder save AJAX action. The issue occurs because the system fails to...

CVE-2026-18439: Authorization Bypass Through User-Controlled Key

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.0.7 via the tutorquizbuildersave AJAX action due to missing validation that nested questionid, answerid, deletedquestionids, and...

WordPress Tutor LMS – eLearning and online course solution plugin <= 4.0.7 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion vulnerability

Authenticated Custom+ Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion vulnerability discovered by Nakul Chodha in WordPress Plugin Tutor LMS versions = 4.0.7...

WordPress Tutor LMS plugin <= 4.0.8 - Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters vulnerability

Reflected Cross-Site Scripting via 'backurl' and 'search' Parameters vulnerability discovered by Filip Kowalski Agentunio in WordPress Plugin Tutor LMS versions = 4.0.8...

CVE-2026-89081

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in all versions up to, and including, 4.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-88944

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.8. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated...

CVE-2026-89333

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.0.8 via the 'studentid' parameter due to missing validation on a user controlled key. This makes it possible for authenticated...

CVE-2026-89081 Tutor LMS <= 4.0.8 - Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in all versions up to, and including, 4.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

EUVD-2026-83477

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in all versions up to, and including, 4.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-89081

The Tutor LMS WordPress plugin (eLearning and online course solution) is affected by Reflected Cross-Site Scripting (XSS) via the 'search' parameter in all versions up to and including 4.0.8 . The root cause is insufficient input sanitization and output escaping . Unauthenticated attackers can in...

CVE-2026-89081 Tutor LMS <= 4.0.8 - Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in all versions up to, and including, 4.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...