What’s Vulnerable › Products
themeum Tutor LMS – eLearning and online course solution vulnerabilities
107 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 58 published in the last 12 months.
Check whether your themeum Tutor LMS – eLearning and online course solution version is affected
Latest themeum Tutor LMS – eLearning and online course solution vulnerabilities
- CVE-2026-111407 — WordPress Tutor LMS plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- CVE-2026-92715 — Tutor LMS <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover via 'ID' Parameter (CVSS 4.3)
- CVE-2026-93681 — Tutor LMS <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name Parameter (CVSS 6.4)
- CVE-2026-88963 — Tutor LMS <= 4.0.8 - Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting via 'redirect_url' Parameter (CVSS 6.1)
- CVE-2026-96537 — Tutor LMS < 4.1.1 - Unauthenticated Tutor Page Force-Publish and Content Overwrite (CVSS 7.5)
- CVE-2026-100193 — Tutor LMS <= 4.1.0 - Reflected Cross-Site Scripting via 'tab' Parameter (CVSS 4.7)
- CVE-2026-42702 — WordPress Tutor LMS plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- CVE-2026-85571 — Tutor LMS 4.0.5 - 4.1.0 - Instructor+ Arbitrary Post Reparenting via IDOR (CVSS 6.5)
- CVE-2026-42698 — WordPress Tutor LMS plugin <= 4.1.1 - Race Condition vulnerability (CVSS 5.3)
- CVE-2026-18439 — Tutor LMS <= 4.0.7 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via 'payload' Parameter (CVSS 4.3)
- CVE-2026-89333 — Tutor LMS <= 4.0.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameter (CVSS 6.5)
- CVE-2026-89081 — Tutor LMS <= 4.0.8 - Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters (CVSS 6.1)
- CVE-2026-88944 — Tutor LMS <= 4.0.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id' Parameter (CVSS 4.3)
- CVE-2026-85572 — Tutor LMS 4.0.0 - < 4.0.8 - Subscriber+ Cross-Course Lesson Comment Disclosure (CVSS 4.3)
- CVE-2026-85569 — Tutor LMS 2.7.1 - < 4.0.8 - Read-Only API Key Privilege Escalation via REST Request Misclassification (CVSS 7.2)
- CVE-2026-78175 — Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution (CVSS 8.8)
- CVE-2026-16759 — Tutor LMS <= 4.0.5 - Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters (CVSS 6.5)
- CVE-2026-19092 — Tutor LMS < 4.0.6 - Unauthenticated Arbitrary Zero-Argument Function Invocation via Template Variable Shadowing (CVSS 9.8)
- CVE-2026-19094 — Tutor LMS < 4.0.6 - Unauthenticated SQLi via 'offset' and 'item_per_page' Parameters (CVSS 5.3)
- CVE-2026-19093 — Tutor LMS < 4.0.6 - Instructor+ Arbitrary File Read via Video Path (CVSS 6.8)
- CVE-2026-14187 — Tutor LMS < 4.0.6 - Instructor+ Cross-Instructor Private Course Disclosure via IDOR (CVSS 2.7)
- CVE-2026-14306 — Tutor LMS < 3.9.14 - Subscriber+ Paid Course Content Disclosure via Enrollment Check Bypass (CVSS 4.3)
- CVE-2026-14310 — Tutor LMS < 4.0.0 - Subscriber+ Cross-Course Q&A Content Disclosure and Reply Injection (CVSS 5.4)
- CVE-2026-15444 — Tutor LMS <= 4.0.1 - Authenticated (Administrator+) SQL Injection via 'coupon_code' Parameter (CVSS 4.9)
- CVE-2026-15022 — Tutor LMS <= 4.0.0 - Authenticated (Subscriber+) SQL Injection via Stored Quiz Answer Array (CVSS 6.5)