Tutor LMS <= 4.2.0 - Authenticated (Tutor Instructor+) Stored Cross-Site Scripting via Withdrawal Account Name
- ID
- WPSEC-2026-2833
- Plugin
- Tutor LMS – eLearning and online course solution (tutor)
- Affected
- from 2.0.0 before 4.2.1
- Remediation
- Update to 4.2.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-10
- Attack surface
- Tutor LMS on WPSec AttackSurface
- Fix released
- Published
Description
The Tutor LMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the withdrawal account name in all versions up to, and including, 4.2.0. This is due to insufficient output escaping in the admin withdrawal approve and reject dialogs, which read the account name and amount from data attributes and insert them into the page with innerHTML. HTML-entity-encoded markup passes the save-time text sanitization and is decoded back into live markup in the browser. This makes it possible for authenticated attackers with Tutor instructor-level access who can submit withdrawal requests to inject arbitrary web scripts that run when an administrator opens the approve or reject dialog.
References
- https://wpsec.com/vuln/WPSEC-2026-2833/
- https://plugins.svn.wordpress.org/tutor/tags/4.2.1/
- https://wordpress.org/plugins/tutor/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS