A reflected XSS flaw exists in the Tutor LMS WordPress plugin. The vulnerability stems from insufficient sanitization of the 'tab' parameter, which is reflected in page output without proper escaping. Because the flaw is triggered only when the lesson page’s navigation array is empty, user‑controlled content is sent directly to the browser. An attacker could embed malicious scripts in a URL that lead a victim to execute arbitrary JavaScript when the victim follows the link. The impact is the execution of arbitrary client‑side code, which can lead to session hijacking, credential theft, or defacement.

The flaw affects all instances of the Tutor LMS eLearning plugin from the first released version up through 4.1.0. Administrators running any of these versions on WordPress sites are vulnerable unless the plugin is updated to a newer release or the parameter is otherwise sanitized.

The CVSS score of 4.7 indicates a moderate severity. The EPSS score of less than 1 % points to a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. An unauthenticated attacker can exploit the flaw by crafting a link containing a malicious 'tab' value and luring a user to visit a lesson page whose navigation items array is empty. Because the trigger condition occurs naturally in lessons with no content, attachments, and comments disabled, the attack surface is not highly limited. Overall the risk is moderate but not urgent compared to more severe flaws.