Improper neutralization of input was discovered in the Tutor LMS plugin for WordPress, allowing a stored cross‑site scripting flaw. When a malicious payload is submitted via an input field that the plugin saves to the database and later renders in a web page, it can steal users’ session data, deface the content or launch phishing attacks. The vulnerability requires the plugin’s input handling code to fail to escape or otherwise sanitize user‑supplied data.

Any WordPress site that has had the Tutor LMS plugin installed with a version from the initial release through 4.1.2 will be vulnerable. The flaw affects the entire plugin suite, including all modules that render user‑generated course or lesson content.

The CVSS score of 6.5 indicates a moderate potential impact. Exploitability is high because the affected content is stored and rendered without validation, making it possible for an attacker to craft a malicious input that is displayed to any visitor. The EPSS score is currently not available, but the flaw is not listed in the CISA KEV catalog. Likely attack vectors involve any user input accepted by the plugin – for example, course description fields, lesson notes or other editable text that the user can submit. Once the payload is stored, every site visitor will be exposed to the script when the page loads.