{
 "id": "WPSEC-2026-2833",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2833/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2833/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2833/index.md",
 "title": "Tutor LMS <= 4.2.0 - Authenticated (Tutor Instructor+) Stored Cross-Site Scripting via Withdrawal Account Name",
 "description": "The Tutor LMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the withdrawal account name in all versions up to, and including, 4.2.0. This is due to insufficient output escaping in the admin withdrawal approve and reject dialogs, which read the account name and amount from data attributes and insert them into the page with innerHTML. HTML-entity-encoded markup passes the save-time text sanitization and is decoded back into live markup in the browser. This makes it possible for authenticated attackers with Tutor instructor-level access who can submit withdrawal requests to inject arbitrary web scripts that run when an administrator opens the approve or reject dialog.",
 "plugin": {
  "slug": "tutor",
  "name": "Tutor LMS",
  "full_name": "Tutor LMS – eLearning and online course solution",
  "wordpress_org": "https://wordpress.org/plugins/tutor/",
  "advisories_url": "https://wpsec.com/vuln/plugin/tutor/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/tutor"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.0.0",
    "from_inclusive": true,
    "to": "4.2.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.0.0 before 4.2.1"
  ]
 },
 "introduced_in": "2.0.0",
 "fixed_in": "4.2.1",
 "remediation": "Update to 4.2.1 or later.",
 "fix_released": "2026-11-09T21:34:13+00:00",
 "published": "2026-11-10T21:42:30+00:00",
 "updated": "2026-11-10T00:16:10.936789+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2833/",
  "https://plugins.svn.wordpress.org/tutor/tags/4.2.1/",
  "https://wordpress.org/plugins/tutor/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/tutor",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-10"
 }
}