Tutor Lms (Unknown) - vulnerabilities (CVEs)
17 CVEs, 2 in the last 30 days, 2 known versions, newest CVE from 2026-10-15. Vendor: Unknown.
CVEs of Tutor Lms
- CVE-2026-96537 - CVSS 7.5 (high), 2026-10-15: The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its managed pages, allowing unauthenticated…
- CVE-2026-85571 - CVSS 6.5 (medium), 2026-10-10: The Tutor LMS WordPress plugin before 4.1.1 does not verify that the posts named in its course content ordering requests belong to a course the requester…
- CVE-2026-85572 - CVSS 4.3 (medium), 2026-09-16: The Tutor LMS WordPress plugin before 4.0.8 does not check that a user has access to a course before returning its lesson discussion content, allowing any…
- CVE-2026-85569 - CVSS 7.2 (high), 2026-09-16: The Tutor LMS WordPress plugin before 4.0.8 does not correctly determine whether an incoming request is addressed to its own REST API, and does not enforce…
- CVE-2026-19092 - CVSS 9.8 (critical), 2026-08-27: The Tutor LMS WordPress plugin before 4.0.6 does not prevent request data from overwriting internal variables while rendering templates, allowing…
- CVE-2026-19094 - CVSS 5.3 (medium), 2026-08-26: The Tutor LMS WordPress plugin before 4.0.6 does not validate values used to build a database query, and does not restrict which template file a request may…
- CVE-2026-19093 - CVSS 6.8 (medium), 2026-08-22: The Tutor LMS WordPress plugin before 4.0.6 does not validate a stored file path before using it to stream media, allowing users with the instructor role to…
- CVE-2026-14187 - CVSS 2.7 (low), 2026-08-22: The Tutor LMS WordPress plugin before 4.0.6 does not enforce per-object ownership checks on its course content type, allowing any user with the instructor…
- CVE-2026-14306 - CVSS 4.3 (medium), 2026-08-06: The Tutor LMS WordPress plugin before 3.9.14 does not properly verify enrollment when restricting access to protected course content, allowing authenticated…
- CVE-2026-14310 - CVSS 5.4 (medium), 2026-07-30: The Tutor LMS WordPress plugin before 4.0.0 does not properly verify that a user has access to the course a Q&A thread belongs to before returning or writing…
- CVE-2026-12274 - CVSS 6.5 (medium), 2026-07-13: The Tutor LMS WordPress plugin before 3.9.13 does not verify that the requesting user is allowed to edit a target post before overwriting it in one of its…
- CVE-2026-12273 - CVSS 4.3 (medium), 2026-07-13: The Tutor LMS WordPress plugin before 3.9.13 does not perform any authorization or post-target validation before creating a comment in one of its handlers,…
- CVE-2026-12275 - CVSS 7.1 (high), 2026-07-13: The Tutor LMS WordPress plugin before 3.9.13 does not, in its Droip and Kirki page-builder integration, perform the enrollment, purchase, and private-course…
- CVE-2026-12271 - CVSS 5.4 (medium), 2026-07-13: The Tutor LMS WordPress plugin before 3.9.13 does not verify ownership of the targeted quiz attempt before writing to it, allowing authenticated users with…
- CVE-2023-4805 - CVSS 5.4 (medium), 2023-10-16: The Tutor LMS WordPress plugin before 2.3.0 does not sanitise and escape some of its settings, which could allow users such as subscriber to perform Stored…
- CVE-2023-3133 - CVSS 7.5 (high), 2023-07-04: The Tutor LMS WordPress plugin before 2.2.1 does not implement adequate permission checks for REST API endpoints, allowing unauthenticated attackers to access…
- CVE-2023-0236 - CVSS 6.1 (medium), 2023-02-06: The Tutor LMS WordPress plugin before 2.0.10 does not sanitise and escape the reset_key and user_id parameters before outputting then back in attributes,…
