CVE-2026-89081

Overview

The Tutor LMS plugin for WordPress up to version 4.0.8 contains a Reflected Cross-Site Scripting vulnerability in the search parameter. This flaw allows unauthenticated remote attackers to inject arbitrary web scripts through improperly sanitized and escaped input. Successful exploitation requires tricking a victim into interacting with a malicious link, potentially leading to unauthorized actions in their browser session.

Description

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in all versions up to, and including, 4.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Impact

This vulnerability impacts the integrity and confidentiality of user sessions within the affected WordPress site by allowing script execution in the context of a victim's browser. Unauthenticated attackers can leverage this to steal session cookies, redirect users, or perform actions on behalf of authenticated users. It primarily threatens site visitors and administrators who interact with crafted links. The overall impact is classified as medium severity.

Remediation

Update the Tutor LMS plugin to version 4.0.9 or later, where input sanitization and output escaping for the search parameter have been properly implemented. If an update is not immediately feasible, deploy a Web Application Firewall (WAF) rule to block requests containing malicious script payloads in the search parameter.

Risk context

The vulnerability carries a CVSS v3 score of 6.1, indicating medium severity, with an exceptionally low EPSS score of 0.00215, suggesting minimal active exploitation in the wild. However, because it requires no authentication to target victims via social engineering, defenders should prioritize patching during standard maintenance cycles.

Affected products

• Themeum Tutor LMS