The Tutor LMS plugin for WordPress is affected by a stored Cross‑Site Scripting flaw that allows an authenticated user with author or higher privileges to embed malicious scripts into the lesson attachment title field. The injected code is not filtered or escaped when rendered on the front‑end, meaning any user who opens a lesson page containing the modified title will execute the attacker’s script within the victim’s browser context. This can lead to session hijacking, defacement, or the spread of malware to site visitors.

The flaw is present in all releases of Tutor LMS up to and including version 3.9.13. The affected components include the Utils.php utility class and the global attachments.php template where the title is displayed. The plugin is developed by the Themeum vendor, and any WordPress site that has an older version of this plugin installed is vulnerable. Upgrading to a later release removes the unsanitized title handling.

The CVSS score of 6.4 places this vulnerability in the medium severity range. The EPSS score is not available, and the flaw is not listed in CISA’s KEV catalog, suggesting it is not a widely exploited or actively weaponized vulnerability at this time. However, because exploitation requires only author‑level access, users who can create or edit lessons can easily insert script payloads. Once dropped, the payload will run for all users who view the affected lesson, creating a broad impact. Consequently, sites with a large user base or high‑value content should treat this flaw as a significant risk.