Skip to content
OpenAdvisories

Product · Themeum

Tutor LMS – eLearning and online course solution

48 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

48 results · Feed

  • Medium 5.4
    CVE-2024-3994

    Tutor LMS – eLearning and online course solution <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tutor_instructor_list' Shortcode

    The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tutor_instructor_list' shortcode in all versions up to, and including, 2.6.2 due to insufficient input sanitization and ou…

    Themeum Tutor LMS – eLearning and online course solution Web / CMS
  • High 8.8
    CVE-2024-1751 Scanner template

    Tutor LMS – eLearning and online course solution <= 2.6.1 - Authenticated (Subscriber+) SQL Injection

    The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the question_id parameter in all versions up to, and including, 2.6.1 due to insufficient escaping on the user supplied parameter and lack …

    Themeum Tutor LMS – eLearning and online course solution Web / CMS
  • Medium 5.4
    CVE-2024-1502

    Tutor LMS – eLearning and online course solution <= 2.6.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion

    The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the tutor_delete_announcement() function in all versions up to, and including, 2.6.1. This makes it possi…

    Themeum Tutor LMS – eLearning and online course solution Web / CMS
  • Medium 4.3
    CVE-2024-1503

    Tutor LMS – eLearning and online course solution <= 2.6.1 - Cross-Site Request Forgery to Plugin Deactivation and Data Erase

    The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.1. This is due to missing or incorrect nonce validation on the erase_tutor_data() function. This ma…

    Themeum Tutor LMS – eLearning and online course solution Web / CMS
  • Medium 4.3
    CVE-2024-1133

    Tutor LMS <= 2.6.0 - Missing Authorization

    The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized access of restricted Q&A content due to a missing capability check when interacting with questions in all versions up to, and including, 2.6.0. This makes …

    Themeum Tutor LMS – eLearning and online course solution Web / CMS
  • Medium 5.4
    CVE-2024-1128

    Tutor LMS <= 2.6.0 - Authenticated(Student+) HTML Injection via Q&A

    The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 2.6.0. This is due to insufficient sanitization of HTML input in the Q&A functionality. This makes it possible for …

    Themeum Tutor LMS – eLearning and online course solution Web / CMS
  • Medium 5.9
    CVE-2023-49829

    WordPress Tutor LMS Plugin <= 2.2.4 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS – eLearning and online course solution allows Stored XSS.This issue affects Tutor LMS – eLearning and online course solution: from n/a thro…

    Themeum Tutor LMS – eLearning and online course solution
  • Unscored —
    CVE-2021-24242

    Tutor LMS < 1.8.8 - Authenticated Local File Inclusion

    The Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.8 is affected by a local file inclusion vulnerability through the maliciously constructed sub_page parameter of the plugin's Tools, allowing high privilege users to include any l…

    Themeum Tutor LMS – eLearning and online course solution Web / CMS