Tutor LMS <= 4.1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name in Consent Logs
- ID
- WPSEC-2026-1061
- Plugin
- Tutor LMS – eLearning and online course solution (tutor)
- Affected
- from 4.0.0 before 4.1.3
- Remediation
- Update to 4.1.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-16
- Attack surface
- Tutor LMS on WPSec AttackSurface
- Fix released
- Published
Description
The Tutor LMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user's display name in the admin Consent Logs modal in versions 4.0.0 up to, and including, 4.1.2. This is due to insufficient output escaping. The modal's user card was built on the client and assigned to innerHTML, and the display name was placed in the avatar image's alt attribute without escaping. Double quotes in a display name survive WordPress and plugin sanitization. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts. The scripts run when an administrator opens that user's consent logs, provided the user has at least one recorded legal consent.
References
- https://wpsec.com/vuln/WPSEC-2026-1061/
- https://plugins.svn.wordpress.org/tutor/tags/4.1.3/
- https://wordpress.org/plugins/tutor/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS