TL
Product
Tutor LMS
59
CVEs
0
On KEV
9.8
Max CVSS
3
New 30D
Severity mix
Critical 2High 19Medium 35Low 3
Watch
Add Tutor LMS to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-4223 | 9.8 | May 16 | The Tutor LMS plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on multiple functions in all… Affected: before 2.7.1 |
| CVE-2023-25700 | 9.8 | Nov 3 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS allows SQL Injection.This issue affects Tutor LMS: from n/a… Affected: through 2.1.10 |
| CVE-2024-43142 | 8.8 | Nov 1 | Missing Authorization vulnerability in Themeum Tutor LMS allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through… Affected: before 2.7.4 |
| CVE-2024-39645 | 8.8 | Aug 26 | Cross-Site Request Forgery (CSRF) vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a through 2.7.2 Affected: before 2.7.3 |
| CVE-2023-25799 | 8.8 | Jun 11 | Missing Authorization vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a through 2.1.8 Affected: before 2.1.9 |
| CVE-2024-4352 | 8.8 | May 16 | The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on the… Affected: before 2.7.1 |
| CVE-2024-4351 | 8.8 | May 16 | The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on the 'authenticate'… Affected: before 2.7.1 |
| CVE-2024-1751 | 8.8 | Mar 13 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the question_id parameter in all versions up to, and… Affected: before 2.6.2 |
| CVE-2023-25990 | 8.8 | Nov 3 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS allows SQL Injection.This issue affects Tutor LMS: from n/a… Affected: through 2.1.10 |
| CVE-2023-25800 | 8.8 | Nov 3 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS allows SQL Injection.This issue affects Tutor LMS: from n/a… Affected: through 2.2.0 |
| CVE-2021-24184 | 8.8 | Apr 5 | Several AJAX endpoints in the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 were unprotected, allowing students to modify course information and… Affected: before 1.7.7 |
| CVE-2024-4222 | 8.2 | May 16 | The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on multiple functions in… Affected: before 2.7.1 |
| CVE-2025-58993 | 7.6 | Sep 9 | WordPress Tutor LMS Plugin <= 3.7.4 - SQL Injection Vulnerability Affected: through 3.7.4 |
| CVE-2024-10400 | 7.5 | Nov 21 | The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via the ‘rating_filter’ parameter in all versions up to, and including, 2.7.6 due to insufficient escaping on the… Affected: through 2.7.6 |
| CVE-2023-3133 | 7.5 | Jul 4 | The Tutor LMS WordPress plugin before 2.2.1 does not implement adequate permission checks for REST API endpoints, allowing unauthenticated attackers to access information from… Affected: before 2.2.1 |
| CVE-2024-43282 | 7.2 | Aug 18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a through 2.7.2 Affected: before 2.7.3 |
| CVE-2024-37266 | 7.2 | Jul 9 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themeum Tutor LMS allows Path Traversal.This issue affects Tutor LMS: from n/a… Affected: before 2.7.2 |
| CVE-2024-37256 | 7.2 | Jul 9 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a through 2.7.1 Affected: before 2.7.2 |
| CVE-2024-4902 | 7.2 | Jun 7 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the ‘course_id’ parameter in all versions up to, and… Affected: before 2.7.2 |
| CVE-2026-42702 | 7.1 | Oct 10 | WordPress Tutor LMS plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability Affected: through 4.1.0 |
| CVE-2024-5784 | 7.1 | Aug 30 | The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized administrative actions execution due to a missing capability checks on multiple functions like… Affected: before 2.7.3 |
| CVE-2026-111407 | 6.5 | Oct 19 | WordPress Tutor LMS plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerability Affected: through 4.1.2 |
| CVE-2026-57694 | 6.5 | Jul 13 | WordPress Tutor LMS plugin <= 3.9.13 - Insecure Direct Object References (IDOR) vulnerability Affected: through 3.9.13 |
| CVE-2026-40743 | 6.5 | Jun 15 | WordPress Tutor LMS plugin <= 3.9.7 - Broken Access Control vulnerability Affected: through 3.9.7 |
| CVE-2025-32223 | 6.5 | Mar 19 | WordPress Tutor LMS plugin <= 3.9.4 - Insecure Direct Object References (IDOR) vulnerability Affected: through 3.9.4 |
| CVE-2026-23799 | 6.5 | Mar 5 | WordPress Tutor LMS plugin <= 3.9.5 - Broken Access Control vulnerability Affected: through 3.9.5 |
| CVE-2024-4318 | 6.5 | May 16 | The Tutor LMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘question_id’ parameter in versions up to, and including, 2.7.0 due to insufficient escaping… Affected: before 2.7.1 |
| CVE-2024-4279 | 6.5 | May 16 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference to Arbitrary Course Deletion in versions up to, and… Affected: before 2.7.1 |
| CVE-2024-3553 | 6.5 | May 2 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the hide_notices… Affected: before 2.7.0 |
| CVE-2021-24186 | 6.5 | Apr 5 | The tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION… Affected: before 1.8.3 |
| CVE-2021-24185 | 6.5 | Apr 5 | The tutor_place_rating AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vulnerable to blind and time based SQL injections… Affected: before 1.7.7 |
| CVE-2021-24183 | 6.5 | Apr 5 | The tutor_quiz_builder_get_question_form AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL… Affected: before 1.8.3 |
| CVE-2021-24182 | 6.5 | Apr 5 | The tutor_quiz_builder_get_answers_by_question AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based… Affected: before 1.8.3 |
| CVE-2021-24181 | 6.5 | Apr 5 | The tutor_mark_answer_as_correct AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vulnerable to blind and time based SQL… Affected: before 1.7.7 |
| CVE-2020-8615 | 6.5 | Feb 4 | A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and performing other malicious actions… Affected: before 1.5.3 |
| CVE-2023-0236 | 6.1 | Feb 6 | The Tutor LMS WordPress plugin before 2.0.10 does not sanitise and escape the reset_key and user_id parameters before outputting then back in attributes, leading to Reflected… Affected: before 2.0.10 |
| CVE-2021-25017 | 6.1 | Jan 24 | The Tutor LMS WordPress plugin before 1.9.12 does not escape the search parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site… Affected: before 1.9.12 |
| CVE-2021-24873 | 6.1 | Nov 23 | The Tutor LMS WordPress plugin before 1.9.11 does not sanitise and escape user input before outputting back in attributes in the Student Registration page, leading to a Reflected… Affected: before 1.9.11 |
| CVE-2026-40740 | 5.4 | Apr 15 | WordPress Tutor LMS plugin <= 3.9.7 - Broken Access Control vulnerability Affected: through 3.9.7 |
| CVE-2024-43231 | 5.4 | Aug 12 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themeum Tutor LMS allows Stored XSS.This issue affects Tutor LMS: from… Affected: before 2.7.4 |
| CVE-2024-3994 | 5.4 | Apr 25 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tutor_instructor_list' shortcode in all… Affected: before 2.7.0 |
| CVE-2023-4805 | 5.4 | Oct 16 | The Tutor LMS WordPress plugin before 2.3.0 does not sanitise and escape some of its settings, which could allow users such as subscriber to perform Stored Cross-Site Scripting… Affected: before 2.3.0 |
| CVE-2021-24455 | 5.4 | Aug 2 | The Tutor LMS – eLearning and online course solution WordPress plugin before 1.9.2 did not escape the Summary field of Announcements (when outputting it in an attribute), which… Affected: before 1.9.2 |
| CVE-2026-42698 | 5.3 | Oct 8 | WordPress Tutor LMS plugin <= 4.1.1 - Race Condition vulnerability Affected: through 4.1.1 |
| CVE-2025-11564 | 5.3 | Oct 25 | Tutor LMS – eLearning and online course solution <= 3.8.3 - Missing Authorization to Unauthenticated Payment Status Update Affected: before 3.9.0 |
| CVE-2024-10393 | 5.3 | Nov 21 | The Tutor LMS plugin for WordPress is vulnerable to bypass to user registration in versions up to, and including, 2.7.6 Affected: through 2.7.6 |
| CVE-2024-37947 | 4.8 | Jul 20 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themeum Tutor LMS allows Stored XSS.This issue affects Tutor LMS: from… Affected: before 2.7.3 |
| CVE-2023-49829 | 4.8 | Dec 15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS – eLearning and online course solution allows Stored… Affected: through 2.2.4 |
| CVE-2022-2563 | 4.8 | Oct 17 | Tutor LMS < 2.0.10 - Admin+ Stored Cross-Site Scripting Affected: before 2.0.10 |
| CVE-2021-24740 | 4.8 | Oct 18 | The Tutor LMS WordPress plugin before 1.9.9 does not escape some of its settings before outputting them in attributes, which could allow high privilege users to perform Cross-Site… Affected: before 1.9.9 |