Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Reflected XSS.This issue affects Tutor LMS: from n/a through 4.1.0.
Published: 2026-10-10
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthenticated Cross‑Site Scripting (XSS)
Action: Patch
AI Analysis

Impact

The vulnerability is an improper neutralization of input during web page generation that allows reflected XSS in the Themeum Tutor LMS plugin. The flaw permits arbitrary JavaScript to be executed in the context of the site’s pages for any visitor that loads a page built by the plugin. The vulnerability affects all releases of Tutor LMS up to 4.1.0, including all earlier versions that were released before the plugin’s first stable release.

Affected Systems

WordPress sites that use the Themeum Tutor LMS plugin version 4.1.0 or any earlier release. Sites that have not applied the 4.1.1 update remain vulnerable.

Risk and Exploitability

The CVSS score of 7.1 indicates high severity, and the EPSS score of <1% shows that exploitation probability is very low. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that a remote attacker can send malicious content via any input handled by the plugin or embed scripts directly in URLs, causing execution in the browsers of site visitors.

Generated by OpenCVE AI on October 17, 2026 at 08:06 UTC.

Remediation

Vendor Solution

Update the WordPress Tutor LMS plugin to the latest available version (at least 4.1.1).

OpenCVE Recommended Actions

  • Update the WordPress Tutor LMS plugin to version 4.1.1 or later.
  • Remove or sanitize any custom code or shortcodes that accept user input within the Tutor LMS context.
  • Deploy a Web Application Firewall or use WordPress security plugins that filter and escape user input to mitigate XSS attempts.

Generated by OpenCVE AI on October 17, 2026 at 08:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 17 Oct 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Themeum
Themeum tutor Lms
Wordpress-extensions
Wordpress-extensions tutor Lms
Vendors & Products Themeum
Themeum tutor Lms
Wordpress-extensions
Wordpress-extensions tutor Lms

Tue, 13 Oct 2026 16:45:00 +0000

Type Values Removed Values Added
Description Unauthenticated Cross Site Scripting (XSS) in Tutor LMS <= 4.1.0 versions. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Reflected XSS.This issue affects Tutor LMS: from n/a through 4.1.0.

Sun, 11 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 10 Oct 2026 19:45:00 +0000

Type Values Removed Values Added
Description Unauthenticated Cross Site Scripting (XSS) in Tutor LMS <= 4.1.0 versions.
Title WordPress Tutor LMS plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

Themeum Tutor Lms
Wordpress-extensions Tutor Lms
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-10-13T16:32:55.073Z

Reserved: 2026-04-29T09:05:07.701Z

Link: CVE-2026-42702

cve-icon Vulnrichment

Updated: 2026-10-11T11:40:29.770Z

cve-icon NVD

Status : Deferred

Published: 2026-10-10T20:16:35.680

Modified: 2026-10-13T17:17:40.803

Link: CVE-2026-42702

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T20:45:07Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')