The vulnerability in the Tutor LMS plugin for WordPress arises from insufficient input sanitization and output escaping of the display_name parameter, allowing an authenticated user with subscriber-level access or higher to store malicious JavaScript code that will run whenever a page containing the input is accessed. This stored cross‑site scripting can be used to hijack sessions, steal cookies, deface content, or execute arbitrary scripts in the context of site visitors, thereby affecting confidentiality and integrity of the site data.

Vendor themeum offers the Tutor LMS – eLearning and online course solution plugin for WordPress. All releases up to and including version 4.1.0 are vulnerable. The vulnerability is evident in the 4.0.9 codebase and earlier. Site owners using any of these affected versions should treat the plugin as compromised until a patched version is installed.

The CVSS score of 6.4 denotes a moderate severity. The EPSS score is currently unavailable, so the exact exploitation frequency is unknown, and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector is through an authenticated session: the exploiter must have a Legal Consent record for his own account, which makes the View Logs button appear in the admin users list. Once the malicious display_name is stored, any user who accesses the affected page will have the injected script executed. Because the flaw requires only subscriber-level authentication, many users may be able to inject payloads, increasing the potential impact.