EN ES
Start free
Menu

Tutor LMS – eLearning and online course solution: known security problems

100 known security problems reported for this WordPress plugin, with the affected versions, the fix and what to do.

Updated

In short

There are 100 known security problems on this page. 99 of them have a fixed version. Updating to version 4.1.3 or newer covers every fixed problem listed here.

Based on public reports. Check the plugin’s changelog. Watchfox AI may be wrong.

Get an email when your site is affected: install Watchfox AI (free)

This week

Anyone with an account on your site, even a basic one could plant harmful code that runs for your visitors or admins (up to and including 4.1.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.1.2
Fixed in
4.1.3
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 4.1.3 or newer.
Official ID
CVE-2026-111407
Report title
Tutor LMS – eLearning and online course solution <= 4.1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with an author account on your site could use it to harm your site

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.1.0
Fixed in
4.1.1
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 4.1.1 or newer.
Official ID
CVE-2026-92715
Report title
Tutor LMS <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover via 'ID' Parameter
First reported
Sources
This week

Anyone with an account on your site, even a basic one could plant harmful code that runs for your visitors or admins (up to and including 4.1.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.1.0
Fixed in
4.1.1
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 4.1.1 or newer.
Official ID
CVE-2026-93681
Report title
Tutor LMS <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name Parameter
First reported
Sources
This week

Anyone with an account on your site, even a basic one could plant harmful code that runs for your visitors or admins (up to and including 4.0.8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.0.8
Fixed in
4.0.9
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 4.0.9 or newer.
Official ID
CVE-2026-88963
Report title
Tutor LMS <= 4.0.8 - Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting via 'redirect_url' Parameter
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 4.1.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.1.0
Fixed in
4.1.1
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 4.1.1 or newer.
Official ID
CVE-2026-100193
Report title
Tutor LMS <= 4.1.0 - Reflected Cross-Site Scripting via 'tab' Parameter
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 4.1.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.1.0
Fixed in
4.1.1
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 4.1.1 or newer.
Official ID
CVE-2026-96537
Report title
Tutor LMS <= 4.1.0 - Missing Authorization
First reported
Sources
This week

Someone could use it to harm your site (from 4.0.5 up to and including 4.1.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 4.0.5 up to and including 4.1.0
Fixed in
4.1.1
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 4.1.1 or newer.
Official ID
CVE-2026-85571
Report title
Tutor LMS 4.0.5 - 4.1.0 - Authenticated (Instructor+) Insecure Direct Object Reference
First reported
Sources
This week

Anyone with an account on your site, even a basic one could use it to harm your site (up to and including 4.1.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.1.2
Fixed in
No fixed version yet
What to do
There is no fixed version yet. If your site uses it, think about turning it off or replacing it until a fix comes out.
Official ID
CVE-2026-42698
Report title
Tutor LMS – eLearning and online course solution <= 4.1.2 - Authenticated (Subscriber+) Race Condition
First reported
Sources
This week

A stranger could plant harmful code that runs for your visitors or admins

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.1.0
Fixed in
4.1.1
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 4.1.1 or newer.
Official ID
CVE-2026-42702
Report title
Tutor LMS – eLearning and online course solution <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting
First reported
Sources
This week

Someone could use it to harm your site (up to and including 4.0.7)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.0.7
Fixed in
4.0.8
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 4.0.8 or newer.
Official ID
CVE-2026-18439
Report title
Tutor LMS <= 4.0.7 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via 'payload' Parameter
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 4.0.8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.0.8
Fixed in
4.0.9
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 4.0.9 or newer.
Official ID
CVE-2026-89081
Report title
Tutor LMS <= 4.0.8 - Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters
First reported
Sources
This week

Anyone with an account on your site, even a basic one could do things on your site they should not be allowed to (up to and including 4.0.8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.0.8
Fixed in
4.0.9
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 4.0.9 or newer.
Official ID
CVE-2026-88944
Report title
Tutor LMS <= 4.0.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id' Parameter
First reported
Sources
This week

Anyone with an account on your site, even a basic one could see private information they should not see (up to and including 4.0.8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.0.8
Fixed in
4.0.9
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 4.0.9 or newer.
Official ID
CVE-2026-89333
Report title
Tutor LMS <= 4.0.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameter
First reported
Sources
This week

Someone could use it to harm your site (up to and including 4.0.7) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.0.7
Fixed in
4.0.8
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 4.0.8 or newer.
Official ID
CVE-2026-85569
Report title
Tutor LMS 2.7.1 - 4.0.7 - REST API Authentication Confusion
First reported
Sources
This week

Anyone with an account on your site, even a basic one could use it to harm your site (up to and including 4.0.7)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.0.7
Fixed in
4.0.8
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 4.0.8 or newer.
Official ID
CVE-2026-85572
Report title
Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) Information Exposure
First reported
Sources
This week

Anyone with an account on your site, even a basic one could run their own code on your site and take it over

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.0.7
Fixed in
4.0.8
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 4.0.8 or newer.
Official ID
CVE-2026-78175
Report title
Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution
First reported
Sources
This week

Someone could read or delete private files on your server (before 4.0.6)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 4.0.6
Fixed in
4.0.6
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 4.0.6 or newer.
Official ID
CVE-2026-19093
Report title
Tutor LMS – eLearning and online course solution < 4.0.6 - Authenticated (Custom Role+) Arbitrary File Read
First reported
Sources
This week

A stranger could run their own code on your site and take it over

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.0.5
Fixed in
4.0.6
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 4.0.6 or newer.
Official ID
CVE-2026-16759
Report title
Tutor LMS <= 4.0.5 - Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters
First reported
Sources
This week

A stranger could use it to harm your site (up to and including 4.0.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.0.5
Fixed in
4.0.6
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 4.0.6 or newer.
Official ID
CVE-2026-19092
Report title
Tutor LMS <= 4.0.5 - Unauthenticated Arbitrary Zero-Argument Function Invocation
First reported
Sources
This week

A stranger could read or change the data in your site’s database (before 4.0.6)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 4.0.6
Fixed in
4.0.6
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 4.0.6 or newer.
Official ID
CVE-2026-19094
Report title
Tutor LMS – eLearning and online course solution < 4.0.6 - Unauthenticated SQL Injection
First reported
Sources
This week

Someone could use it to harm your site (up to and including 4.0.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.0.5
Fixed in
4.0.6
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 4.0.6 or newer.
Official ID
CVE-2026-14187
Report title
Tutor LMS <= 4.0.5 - Authenticated (Instructor+) Insecure Direct Object Reference
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (before 4.0.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 4.0.0
Fixed in
4.0.0
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 4.0.0 or newer.
Official ID
CVE-2026-14310
Report title
Tutor LMS – eLearning and online course solution < 4.0.0 - Missing Authorization
First reported
Sources
This week

Someone who already has an admin account could read or change the data in your site’s database (up to and including 4.0.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.0.1
Fixed in
4.0.2
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 4.0.2 or newer.
Official ID
CVE-2026-15444
Report title
Tutor LMS <= 4.0.1 - Authenticated (Administrator+) SQL Injection via 'coupon_code' Parameter
First reported
Sources
This week

Anyone with an account on your site, even a basic one could read or change the data in your site’s database (up to and including 4.0.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 4.0.0
Fixed in
4.0.1
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 4.0.1 or newer.
Official ID
CVE-2026-15022
Report title
Tutor LMS <= 4.0.0 - Authenticated (Subscriber+) SQL Injection via Stored Quiz Answer Array
First reported
Sources
This week

A stranger could use it to harm your site (up to and including 3.9.13)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.9.13
Fixed in
3.9.14
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 3.9.14 or newer.
Official ID
CVE-2026-57694
Report title
Tutor LMS – eLearning and online course solution <= 3.9.13 - Unauthenticated Insecure Direct Object Reference
First reported
Sources
This week

Anyone with an account on your site, even a basic one could use it to harm your site (up to and including 3.9.13)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.9.13
Fixed in
3.9.14
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 3.9.14 or newer.
Official ID
CVE-2026-14306
Report title
Tutor LMS <= 3.9.13 - Authenticated (Subscriber+) Information Exposure
First reported
Sources
This week

Someone with an author account on your site could plant harmful code that runs for your visitors or admins

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.9.13
Fixed in
3.9.14
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 3.9.14 or newer.
Official ID
CVE-2026-13443
Report title
Tutor LMS <= 3.9.13 - Authenticated (Author+) Stored Cross-Site Scripting via Lesson Attachment Title
First reported
Sources
This week

Anyone with an account on your site, even a basic one could use it to harm your site (up to and including 3.9.12)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.9.12
Fixed in
3.9.13
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 3.9.13 or newer.
Official ID
CVE-2026-12275
Report title
Tutor LMS <= 3.9.12 - Authenticated (Subscriber+) Information Disclosure
First reported
Sources
This week

Anyone with an account on your site, even a basic one could do things on your site they should not be allowed to (up to and including 3.9.12)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.9.12
Fixed in
3.9.13
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 3.9.13 or newer.
Official ID
CVE-2026-12273
Report title
Tutor LMS <= 3.9.12 - Missing Authorization to Authenticated (Subscriber+) Comment Creation
First reported
Sources
This week

Anyone with an account on your site, even a basic one could use it to harm your site (up to and including 3.9.12) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.9.12
Fixed in
3.9.13
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 3.9.13 or newer.
Official ID
CVE-2026-12271
Report title
Tutor LMS <= 3.9.12 - Authenticated (Subscriber+) Insecure Direct Object Reference to Quiz Attemp Modification
First reported
Sources
This week

Someone who already has an admin account could read or change the data in your site’s database (up to and including 3.9.11)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.9.11
Fixed in
3.9.12
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 3.9.12 or newer.
Official ID
CVE-2026-10736
Report title
Tutor LMS <= 3.9.11 - Authenticated (Administrator+) SQL Injection via 'data' Parameter
First reported
Sources
This week

Someone could use it to harm your site (up to and including 3.9.9)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.9.9
Fixed in
3.9.10
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 3.9.10 or newer.
Official ID
CVE-2026-6965
Report title
Tutor LMS <= 3.9.9 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Post Deletion via 'course' GET Parameter
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 3.9.7)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.9.7
Fixed in
3.9.8
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 3.9.8 or newer.
Official ID
CVE-2026-40743
Report title
Tutor LMS – eLearning and online course solution <= 3.9.7 - Missing Authorization
First reported
Sources
This week

Someone could read or change the data in your site’s database (up to and including 3.9.8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.9.8
Fixed in
3.9.9
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 3.9.9 or newer.
Official ID
CVE-2026-6080
Report title
Tutor LMS <= 3.9.8 - Authenticated (Admin+) SQL Injection via 'date' Parameter
First reported
Sources
This week

Anyone with an account on your site, even a basic one could use it to harm your site (up to and including 3.9.8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.9.8
Fixed in
3.9.9
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 3.9.9 or newer.
Official ID
CVE-2026-5502
Report title
Tutor LMS <= 3.9.8 - Authenticated (Subscriber+) Arbitrary Course Content Manipulation via tutor_update_course_content_order
First reported
Sources
This week

Anyone with an account on your site, even a basic one could use it to harm your site (up to and including 3.9.7)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.9.7
Fixed in
3.9.8
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 3.9.8 or newer.
Official ID
CVE-2026-3371
Report title
Tutor LMS <= 3.9.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Course Content Modification
First reported
Sources
This week

Anyone with an account on your site, even a basic one could do things on your site they should not be allowed to (up to and including 3.9.7)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.9.7
Fixed in
3.9.8
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 3.9.8 or newer.
Official ID
CVE-2026-3358
Report title
Tutor LMS <= 3.9.7 - Missing Authorization to Authenticated (Subscriber+) Unauthorized Private Course Enrollment
First reported
Sources
This week

A stranger could do things on your site they should not be allowed to (up to and including 3.9.7)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.9.7
Fixed in
3.9.8
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 3.9.8 or newer.
Official ID
CVE-2026-3360
Report title
Tutor LMS <= 3.9.7 - Missing Authorization to Unauthenticated Arbitrary Billing Profile Overwrite via 'order_id' Parameter
First reported
Sources
This week

Anyone with an account on your site, even a basic one could use it to harm your site (up to and including 3.9.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.9.4
Fixed in
3.9.5
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 3.9.5 or newer.
Official ID
CVE-2025-32223
Report title
Tutor LMS – eLearning and online course solution <= 3.9.4 - Authenticated (Subscriber+) Insecure Direct Object Reference
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 3.9.7) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.9.7
Fixed in
3.9.8
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 3.9.8 or newer.
Official ID
CVE-2026-40740
Report title
Tutor LMS <= 3.9.7 - Missing Authorization
First reported
Sources
This week

A stranger could read or change the data in your site’s database (up to and including 3.9.6)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.9.6
Fixed in
3.9.7
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 3.9.7 or newer.
Official ID
CVE-2025-13673
Report title
Tutor LMS <= 3.9.6 - Unauthenticated SQL Injection via coupon_code
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 3.9.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.9.5
Fixed in
3.9.6
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 3.9.6 or newer.
Official ID
CVE-2026-23799
Report title
Tutor LMS – eLearning and online course solution <= 3.9.5 - Missing Authorization
First reported
Sources
This week

Anyone with an account on your site, even a basic one could use it to harm your site (up to and including 3.9.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.9.5
Fixed in
3.9.6
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 3.9.6 or newer.
Official ID
CVE-2026-1371
Report title
Tutor LMS <= 3.9.5 - Authenticated (Subscriber+) Information Disclosure in Coupon Details via 'tutor_coupon_details' AJAX Action
First reported
Sources
This week

Someone could use it to harm your site (up to and including 3.9.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.9.5
Fixed in
3.9.6
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 3.9.6 or newer.
Official ID
CVE-2026-1375
Report title
Tutor LMS <= 3.9.5 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Course Modification and Deletion
First reported
Sources
This week

Anyone with an account on your site, even a basic one could do things on your site they should not be allowed to (up to and including 3.9.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.9.4
Fixed in
3.9.5
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 3.9.5 or newer.
Official ID
CVE-2026-0548
Report title
Tutor LMS – eLearning and online course solution <= 3.9.4 - Missing Authorization to Authenticated (Subscriber+) Limited Attachment Deletion
First reported
Sources
This week

Anyone with an account on your site, even a basic one could do things on your site they should not be allowed to (up to and including 3.9.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.9.3
Fixed in
3.9.4
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 3.9.4 or newer.
Official ID
CVE-2025-13628
Report title
Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Coupon Modification
First reported
Sources
This week

Anyone with an account on your site, even a basic one could do things on your site they should not be allowed to (up to and including 3.9.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.9.2
Fixed in
3.9.4
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 3.9.4 or newer.
Official ID
CVE-2025-13935
Report title
Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Course Completion
First reported
Sources
This week

Anyone with an account on your site, even a basic one could do things on your site they should not be allowed to (up to and including 3.9.3) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.9.3
Fixed in
3.9.4
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 3.9.4 or newer.
Official ID
CVE-2025-13934
Report title
Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Course Enrollment Bypass
First reported
Sources
This week

Anyone with an account on your site, even a basic one could see private information they should not see (up to and including 3.9.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.9.3
Fixed in
3.9.4
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 3.9.4 or newer.
Official ID
CVE-2025-13679
Report title
Tutor LMS <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via tutor_order_details
First reported
Sources
This week

Someone could use it to harm your site (up to and including 3.9.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.9.4
Fixed in
3.9.5
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 3.9.5 or newer.
Official ID
CVE-2025-47555
Report title
Tutor LMS <= 3.9.4 - Authenticated (Instructor+) Insecure Direct Object Reference
First reported
Sources
This week

Someone could see private information they should not see

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.8.3
Fixed in
3.9.0
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 3.9.0 or newer.
Official ID
CVE-2025-6680
Report title
Tutor LMS <= 3.8.3 - Missing Authorization to Sensitive Information Exposure
First reported
Sources
This week

A stranger could do things on your site they should not be allowed to (up to and including 3.8.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.8.3
Fixed in
3.9.0
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 3.9.0 or newer.
Official ID
CVE-2025-11564
Report title
Tutor LMS – eLearning and online course solution <= 3.8.3 - Missing Authorization to Unauthenticated Payment Status Update
First reported
Sources
This week

Someone who already has an admin account could read or change the data in your site’s database (up to and including 3.7.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.7.4
Fixed in
3.8.0
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 3.8.0 or newer.
Official ID
CVE-2025-58993
Report title
Tutor LMS <= 3.7.4 - Authenticated (Administrator+) SQL Injection
First reported
Sources
This week

Anyone with an account on your site, even a basic one could use it to harm your site (up to and including 3.4.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.4.0
Fixed in
3.4.1
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 3.4.1 or newer.
Official ID
CVE-2025-32230
Report title
Tutor LMS <= 3.4.0 - Authenticated (Subscriber+) HTML Injection
First reported
Sources
This week

A stranger could read or change the data in your site’s database (up to and including 2.7.6)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.7.6
Fixed in
2.7.7
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 2.7.7 or newer.
Official ID
CVE-2024-10400
Report title
Tutor LMS <= 2.7.6 - Unauthenticated SQL Injection via rating_filter
First reported
Sources
This week

Someone could use it to harm your site (up to and including 2.7.6)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.7.6
Fixed in
2.7.7
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 2.7.7 or newer.
Official ID
CVE-2024-10393
Report title
Tutor LMS <= 2.7.6 - User Registration Setting Bypass to Unauthorized User Registration
First reported
Sources
This week

Someone could trick a logged-in admin into changing settings without knowing (up to and including 2.7.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.7.4
Fixed in
2.7.5
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 2.7.5 or newer.
Official ID
CVE-2023-2919
Report title
Tutor LMS <= 2.7.4 - Cross-Site Request Forgery via 'addon_enable_disable'
First reported
Sources
This week

Someone who already has an admin account could read or change the data in your site’s database (up to and including 2.7.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.7.2
Fixed in
2.7.3
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 2.7.3 or newer.
Official ID
CVE-2024-43282
Report title
Tutor LMS <= 2.7.2 - Authenticated (Administrator+) SQL Injection
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.7.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.7.3
Fixed in
2.7.4
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 2.7.4 or newer.
Official ID
CVE-2024-43231
Report title
Tutor LMS <= 2.7.3 - Authenticated (Instructor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 2.7.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.7.3
Fixed in
2.7.4
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 2.7.4 or newer.
Official ID
CVE-2024-43142
Report title
Tutor LMS <= 2.7.3 - Missing Authorization
First reported
Sources
This week

Someone could trick a logged-in admin into changing settings without knowing (up to and including 2.7.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.7.2
Fixed in
2.7.3
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 2.7.3 or newer.
Official ID
CVE-2024-39645
Report title
Tutor LMS <= 2.7.2 - Cross-Site Request Forgery
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.7.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.7.2
Fixed in
2.7.3
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 2.7.3 or newer.
Official ID
CVE-2024-37947
Report title
Tutor LMS <= 2.7.2 - Authenticated (Tutor Instructor+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone could read or delete private files on your server (up to and including 2.7.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.7.1
Fixed in
2.7.2
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 2.7.2 or newer.
Official ID
CVE-2024-37266
Report title
Tutor LMS <= 2.7.1 - Authenticated (Admin+) Path Traversal
First reported
Sources
This week

Someone who already has an admin account could read or change the data in your site’s database (up to and including 2.7.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.7.1
Fixed in
2.7.2
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 2.7.2 or newer.
Official ID
CVE-2024-4902
Report title
Tutor LMS – eLearning and online course solution <= 2.7.1 -Authenticated (Administrator+) SQL Injection
First reported
Sources
This week

Someone could use it to harm your site (up to and including 2.7.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.7.1
Fixed in
2.7.2
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 2.7.2 or newer.
Official ID
CVE-2024-5438
Report title
Tutor LMS – eLearning and online course solution <= 2.7.1 - Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Quiz Attempt Deletion
First reported
Sources
This week

Someone could use it to harm your site (up to and including 2.7.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.7.0
Fixed in
2.7.1
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 2.7.1 or newer.
Official ID
CVE-2024-4279
Report title
Tutor LMS – eLearning and online course solution <= 2.7.0 - Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Course Deletion
First reported
Sources
This week

Someone could read or change the data in your site’s database (up to and including 2.7.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.7.0
Fixed in
2.7.1
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 2.7.1 or newer.
Official ID
CVE-2024-4318
Report title
Tutor LMS <= 2.7.0 - Authenticated (Instructor+) SQL Injection
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 2.7.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.7.0
Fixed in
2.7.1
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 2.7.1 or newer.
Official ID
CVE-2024-4223
Report title
Tutor LMS <= 2.7.0 - Missing Authorization
First reported
Sources
This week

A stranger could do things on your site they should not be allowed to (up to and including 2.6.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.6.2
Fixed in
2.7.0
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 2.7.0 or newer.
Official ID
CVE-2024-3553
Report title
Tutor LMS <= 2.6.2 - Missing Authorization to Unauthenticated Limited Options Update
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.6.2
Fixed in
2.7.0
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 2.7.0 or newer.
Official ID
CVE-2024-3994
Report title
Tutor LMS – eLearning and online course solution <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tutor_instructor_list' Shortcode
First reported
Sources
This week

Someone could trick a logged-in admin into changing settings without knowing (up to and including 2.6.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.6.1
Fixed in
2.6.2
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 2.6.2 or newer.
Official ID
CVE-2024-1503
Report title
Tutor LMS – eLearning and online course solution <= 2.6.1 - Cross-Site Request Forgery to Plugin Deactivation and Data Erase
First reported
Sources
This week

Anyone with an account on your site, even a basic one could do things on your site they should not be allowed to (up to and including 2.6.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.6.1
Fixed in
2.6.2
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 2.6.2 or newer.
Official ID
CVE-2024-1502
Report title
Tutor LMS – eLearning and online course solution <= 2.6.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion
First reported
Sources
This week

Anyone with an account on your site, even a basic one could read or change the data in your site’s database (up to and including 2.6.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.6.1
Fixed in
2.6.2
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 2.6.2 or newer.
Official ID
CVE-2024-1751
Report title
Tutor LMS – eLearning and online course solution <= 2.6.1 - Authenticated (Subscriber+) SQL Injection
First reported
Sources
This week

Someone could use it to harm your site (up to and including 2.6.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.6.0
Fixed in
2.6.1
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 2.6.1 or newer.
Official ID
CVE-2024-1128
Report title
Tutor LMS <= 2.6.0 - Authenticated(Student+) HTML Injection via Q&A
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 2.6.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.6.0
Fixed in
2.6.1
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 2.6.1 or newer.
Official ID
CVE-2024-1133
Report title
Tutor LMS <= 2.6.0 - Missing Authorization
First reported
Sources
This week

Someone who already has an admin account could plant harmful code that runs for your visitors or admins (up to and including 2.2.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.2.4
Fixed in
2.3.0
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 2.3.0 or newer.
Official ID
CVE-2023-49829
Report title
Tutor LMS <= 2.2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
First reported
Sources
This week

Anyone with an account on your site, even a basic one could plant harmful code that runs for your visitors or admins (up to and including 2.2.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.2.4
Fixed in
2.3.0
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 2.3.0 or newer.
Official ID
CVE-2023-4805
Report title
Tutor LMS <= 2.2.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 2.2.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.2.0
Fixed in
2.2.1
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 2.2.1 or newer.
Official ID
CVE-2023-3133
Report title
Tutor LMS <= 2.2.0 - Missing Authorization via REST API
First reported
Sources
This week

Someone could read or change the data in your site’s database (up to and including 2.2.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.2.0
Fixed in
2.2.1
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 2.2.1 or newer.
Official ID
CVE-2023-25800
Report title
Tutor LMS <= 2.2.0 - Authenticated (Student+) SQL Injection
First reported
Sources
This week

Someone could read or change the data in your site’s database (up to and including 2.1.10)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.1.10
Fixed in
2.2.0
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 2.2.0 or newer.
Official ID
CVE-2023-25990
Report title
Tutor LMS <= 2.1.10 - Authenticated (Tutor Instructor+) SQL Injection
First reported
Sources
This week

A stranger could read or change the data in your site’s database (up to and including 2.1.10)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.1.10
Fixed in
2.2.0
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 2.2.0 or newer.
Official ID
CVE-2023-25700
Report title
Tutor LMS <= 2.1.10 - Unauthenticated SQL Injection
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 2.1.8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.1.8
Fixed in
2.1.9
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 2.1.9 or newer.
Official ID
CVE-2023-25799
Report title
Tutor LMS <= 2.1.8 - Missing Authorization via multiple AJAX actions
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.0.9)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.9
Fixed in
2.0.10
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 2.0.10 or newer.
Official ID
CVE-2023-0236
Report title
Tutor LMS <= 2.0.9 - Reflected Cross-Site Scripting
First reported
Sources
This week

Someone who already has an admin account could plant harmful code that runs for your visitors or admins (up to and including 2.0.9)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.0.9
Fixed in
2.0.10
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 2.0.10 or newer.
Official ID
CVE-2022-2563
Report title
Tutor LMS <= 2.0.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (from 2.0.0 up to and including 2.0.8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 2.0.0 up to and including 2.0.8
Fixed in
2.0.9
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 2.0.9 or newer.
Report title
Tutor LMS – eLearning and online course solution 2.0.0-2.0.8 - Reflected Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 1.9.11)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.9.11
Fixed in
1.9.12
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 1.9.12 or newer.
Report title
Tutor LMS <= 1.9.11 - Stored Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 1.9.11) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.9.11
Fixed in
1.9.12
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 1.9.12 or newer.
Official ID
CVE-2021-25017
Report title
Tutor LMS <= 1.9.11 - Reflected Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 1.9.10)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.9.10
Fixed in
1.9.11
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 1.9.11 or newer.
Official ID
CVE-2021-24873
Report title
Tutor LMS <= 1.9.10 - Reflected Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 1.9.9)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 1.9.9
Fixed in
1.9.9
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 1.9.9 or newer.
Official ID
CVE-2021-24740
Report title
Tutor LMS <= 1.9.8 - Admin+ Stored Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 1.9.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.9.5
Fixed in
1.9.6
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 1.9.6 or newer.
Report title
Tutor LMS <= 1.9.5 - Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 1.9.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.9.1
Fixed in
1.9.2
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 1.9.2 or newer.
Official ID
CVE-2021-24455
Report title
Tutor LMS <= 1.9.1 - Authenticated Stored Cross-Site Scripting
First reported
Sources
This week

Someone could read or delete private files on your server (up to and including 1.8.7)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.8.7
Fixed in
1.8.8
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 1.8.8 or newer.
Official ID
CVE-2021-24242
Report title
Tutor LMS <= 1.8.7 - Authenticated Local File Inclusion
First reported
Sources
This week

Someone could take over your site as an admin

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 1.7.7
Fixed in
1.7.7
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 1.7.7 or newer.
Official ID
CVE-2021-24184
Report title
Tutor LMS – eLearning and online course solution <= 1.7.6 - Unprotected AJAX including Privilege Escalation
First reported
Sources
This week

Someone could read or change the data in your site’s database (up to and including 1.8.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.8.2
Fixed in
1.8.3
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 1.8.3 or newer.
Official ID
CVE-2021-24183
Report title
Tutor LMS <= 1.8.2 - SQL Injection via tutor_quiz_builder_get_question_form
First reported
Sources
This week

Someone could read or change the data in your site’s database (before 1.7.7)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 1.7.7
Fixed in
1.7.7
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 1.7.7 or newer.
Official ID
CVE-2021-24185
Report title
Tutor LMS – eLearning and online course solution <=1.7.6 - SQL Injection
First reported
Sources
This week

Someone could read or change the data in your site’s database (before 1.7.7) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 1.7.7
Fixed in
1.7.7
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 1.7.7 or newer.
Official ID
CVE-2021-24181
Report title
Tutor LMS – eLearning and online course solution <= 1.7.6 - SQL Injection
First reported
Sources
This week

Someone could read or change the data in your site’s database (up to and including 1.8.2) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.8.2
Fixed in
1.8.3
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 1.8.3 or newer.
Official ID
CVE-2021-24182
Report title
Tutor LMS <=1.8.2 - SQL Injection via tutor_quiz_builder_get_answers_by_question
First reported
Sources
This week

Someone could read or change the data in your site’s database (before 1.8.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 1.8.3
Fixed in
1.8.3
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 1.8.3 or newer.
Official ID
CVE-2021-24186
Report title
Tutor LMS <=1.8.2 - SQL Injection via tutor_answering_quiz_question/get_answer_by_id
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 1.9.12)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 1.9.12
Fixed in
1.9.13
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 1.9.13 or newer.
Report title
Tutor LMS <= 1.9.12 - Reflected Cross-Site Scripting
First reported
Sources
This week

Someone could trick a logged-in admin into changing settings without knowing (before 1.5.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 1.5.3
Fixed in
1.5.3
What to do
If your site has an affected version, update Tutor LMS – eLearning and online course solution to version 1.5.3 or newer.
Official ID
CVE-2020-8615
Report title
Tutor LMS < 1.5.3 - Cross-Site Request Forgery
First reported
Sources

Where this comes from

We collect these reports from public security sources and rewrite them in plain words. Each problem shows its sources and the date we first saw it. This page never says whether your own site is affected: only a check of your site’s versions can tell.

All plugins and themes

Get an email when your site is affected.

Install Watchfox AI once. It checks your plugins and themes against this list every day, for free.

Install Watchfox AI (free)