The Tutor LMS WordPress plugin contains a DOM-based cross‑site scripting flaw in the Topbar component’s back button handler. The flaw is triggered by supplying a malicious payload through the redirect_url parameter, which is inserted into the page’s JavaScript context without proper validation or encoding. An attacker who crafts a link containing the payload can cause any user who follows the link to execute arbitrary JavaScript in the victim’s browser. The impact is compromised confidentiality and integrity of the victim’s session, including the ability to run code in the context of the site or the user’s account, and is classified as medium severity (CVSS 6.1).

WordPress sites deploying the Tutor LMS plugin from themeum, any release up through version 4.0.8.

The CVSS score of 6.1 indicates medium severity. The EPSS score is < 1%, indicating a very low probability of exploitation. The flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that the vulnerability can be exploited by unauthenticated users, although the title indicates it may require authenticated (Subscriber+) access. An attacker can exploit the vulnerability by embedding a malicious payload into the redirect_url parameter of a link; when a user follows that link, the payload is reflected into client‑side JavaScript and executes with the victim’s browser context, enabling arbitrary script execution.