Skip to content
OpenAdvisories

Product · Themeum

Tutor LMS Elementor Addons

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 4.3
    CVE-2026-1372

    Tutor LMS Elementor Addons <= 4.0.0 - Missing Authorization to Authenticated (Subscriber+) Tutor LMS and Elementor Plugin Activation

    The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.0.0 This is due to missing capability checks on the `activate_tutor_free()` and `activate_elementor_free()` functions registered…

    Themeum Tutor LMS Elementor Addons Web / CMS
  • Medium 6.5
    CVE-2025-63042

    WordPress Tutor LMS Elementor Addons plugin <= 3.0.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS Elementor Addons tutor-lms-elementor-addons allows Stored XSS.This issue affects Tutor LMS Elementor Addons: from n/a through <= 3.0.1.

    Themeum Tutor LMS Elementor Addons
  • Medium 4.3
    CVE-2024-53816

    WordPress Tutor LMS Elementor Addons plugin <= 2.1.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Themeum Tutor LMS Elementor Addons tutor-lms-elementor-addons.This issue affects Tutor LMS Elementor Addons: from n/a through <= 2.1.5.

    Themeum Tutor LMS Elementor Addons
  • Medium 4.3
    CVE-2024-10897

    Tutor LMS Elementor Addons <= 2.1.5 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation

    The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the install_etlms_dependency_plugin() function in all versions up to, and including, 2.1.5. This makes it possible for a…

    Themeum Tutor LMS Elementor Addons Web / CMS
  • Medium 6.4
    CVE-2024-5576

    Tutor LMS Elementor Addons <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Course Carousel Widget

    The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'course_carousel_skin' attribute within the plugin's Course Carousel widget in all versions up to, and including, 2.1.4 due to insufficient input sanitiza…

    Themeum Tutor LMS Elementor Addons Web / CMS
  • Medium 6.5
    CVE-2024-29913

    WordPress Tutor LMS Elementor Addons plugin <= 2.1.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS Elementor Addons allows Stored XSS.This issue affects Tutor LMS Elementor Addons: from n/a through 2.1.3.

    Themeum Tutor LMS Elementor Addons