Tutor LMS – eLearning and online course solution Security: 48 Known Vulnerabilities

CVE-2026-8502 UNKNOWN EPSS 0.4%

Published 2026-06-06 · Affected: *

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.6 via the 'retur

CVE-2026-6080 UNKNOWN EPSS 0.4%

Published 2026-04-17 · Affected: *

The Tutor LMS plugin for WordPress is vulnerable to SQL Injection in versions up to and including 3.9.8. This is due to insufficient escaping on the 'date' parameter combined with direct interpolation

CVE-2026-5502 UNKNOWN EPSS 0.4%

Published 2026-04-17 · Affected: *

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized course content manipulation in versions up to and including 3.9.8. This is due to a missing auth

CVE-2026-3371 UNKNOWN EPSS 0.3%

Published 2026-04-11 · Affected: *

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.9.7. This is due to missing authoriz

CVE-2026-3358 UNKNOWN EPSS 0.3%

Published 2026-04-11 · Affected: *

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized private course enrollment in all versions up to, and including, 3.9.7. This is due to missing po

CVE-2026-3360 UNKNOWN EPSS 0.5%

Published 2026-04-10 · Affected: *

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to an Insecure Direct Object Reference in all versions up to, and including, 3.9.7. This is due to missing authe

CVE-2026-4333 UNKNOWN EPSS 0.2%

Published 2026-04-08 · Affected: *

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'skin' attribute of the learn_press_courses shortcode in all versions up to and includin

CVE-2026-3225 UNKNOWN EPSS 0.2%

Published 2026-03-23 · Affected: *

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized deletion of quiz question answers due to a missing capability check in the delete_question_answer() function of

CVE-2026-3226 UNKNOWN EPSS 0.1%

Published 2026-03-12 · Affected: *

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized email notification triggering due to missing capability checks on all 10 functions in the SendEmailAjax class i

CVE-2025-13673 UNKNOWN EPSS 0.4%

Published 2026-02-28 · Affected: *

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to SQL Injection via the 'coupon_code' parameter in all versions up to, and including, 3.9.6 due to insufficient

CVE-2026-1375 UNKNOWN EPSS 0.3%

Published 2026-02-03 · Affected: *

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object References (IDOR) in all versions up to, and including, 3.9.5. This is due to missing

CVE-2026-1371 UNKNOWN EPSS 0.2%

Published 2026-02-03 · Affected: *

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.5. This is due to missing authorizat

CVE-2025-15521 UNKNOWN EPSS 0.3%

Published 2026-01-21 · Affected: *

The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.5.0. This

CVE-2026-0548 UNKNOWN EPSS 0.2%

Published 2026-01-20 · Affected: *

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized attachment deletion due to a missing capability check on the `delete_existing_user_photo` functi

CVE-2025-14798 UNKNOWN EPSS 0.2%

Published 2026-01-20 · Affected: *

The LearnPress – WordPress LMS Plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.3.2.4 via the get_item_permissions_check function. This makes it

CVE-2025-13935 UNKNOWN EPSS 0.1%

Published 2026-01-09 · Affected: *

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized course completion in all versions up to, and including, 3.9.2. This is due to missing enrollment

CVE-2025-13934 UNKNOWN EPSS 0.1%

Published 2026-01-09 · Affected: *

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized course enrollment in all versions up to, and including, 3.9.3. This is due to a missing capabili

CVE-2025-13628 UNKNOWN EPSS 0.1%

Published 2026-01-09 · Affected: *

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification and deletion of data due to a missing capability check on the 'bulk_action_handler'

CVE-2025-13679 UNKNOWN EPSS 0.1%

Published 2026-01-08 · Affected: *

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_order_by_id() function in all versio

CVE-2025-14802 UNKNOWN EPSS 0.2%

Published 2026-01-07 · Affected: *

The LearnPress – WordPress LMS Plugin for WordPress is vulnerable to unauthorized file deletion in versions up to, and including, 4.3.2.2 via the /wp-json/lp/v1/material/{file_id} REST API endpoint. T

CVE-2025-13964 UNKNOWN EPSS 0.2%

Published 2026-01-06 · Affected: *

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the catch_lp_ajax function in all versions up to, and

CVE-2025-13956 UNKNOWN EPSS 0.6%

Published 2025-12-16 · Affected: *

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the statistic function in all versions up to, and including

CVE-2025-14387 UNKNOWN EPSS 0.1%

Published 2025-12-15 · Affected: *

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.3.1 due to insufficient input sanitization and output es

CVE-2025-14156 UNKNOWN EPSS 0.9%

Published 2025-12-15 · Affected: *

The Fox LMS – WordPress LMS Plugin plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.0.5.1. This is due to the plugin not properly validating the 'role

CVE-2025-65681 UNKNOWN EPSS 0.1%

Published 2025-11-26 · Affected: <20.0.2

An issue was discovered in Overhang.IO (tutor-open-edx) (overhangio/tutor) 20.0.2 allowing local unauthorized attackers to gain access to sensitive information due to the absence of proper cache-contr

CVE-2025-11368 UNKNOWN EPSS 0.6%

Published 2025-11-21 · Affected: *

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 4.2.9.4. This is due to missing capability checks in

CVE-2025-12099 UNKNOWN EPSS 0.4%

Published 2025-11-08 · Affected: *

The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.3.8 via deserialization of unt

CVE-2025-12098 UNKNOWN EPSS 0.2%

Published 2025-11-08 · Affected: *

The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.8 via the 'enqueue

CVE-2025-6680 UNKNOWN EPSS 0.1%

Published 2025-10-25 · Affected: *

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.8.3. This makes it possible for authen

CVE-2025-6639 UNKNOWN EPSS 0.1%

Published 2025-10-25 · Affected: *

The Tutor LMS Pro – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.8.3 due to missing validation on

CVE-2025-11564 UNKNOWN EPSS 0.2%

Published 2025-10-25 · Affected: *

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check while verifying webhook signatures on the

CVE-2025-11086 UNKNOWN EPSS 0.3%

Published 2025-10-22 · Affected: *

The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.3.7. This is due to the plugin

CVE-2025-11372 UNKNOWN EPSS 0.4%

Published 2025-10-18 · Affected: *

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to modification of data in all versions up to, and including, 4.2.9.2. This is due to missing capability checks on the Admin To

CVE-2025-7841 UNKNOWN

Published 2025-08-23 · Affected: *

The Sertifier Certificate & Badge Maker for WordPress – Tutor LMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.19. This is due to missing or

CVE-2024-10470 UNKNOWN EPSS 1.0%

Published 2024-11-09 · Affected: *

The WPLMS Learning Management System for WordPress, WordPress LMS theme for WordPress is vulnerable to arbitrary file read and deletion due to insufficient file path validation and permissions checks

CVE-2024-9270 UNKNOWN EPSS 0.3%

Published 2024-11-09 · Affected: *

The Lenxel Core for Lenxel(LNX) LMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.2.3 due to insufficient input sanitiz

CVE-2024-5438 UNKNOWN EPSS 0.3%

Published 2024-06-07 · Affected: *

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.7.1 via the 'attempt_delete' functio

CVE-2024-4902 UNKNOWN EPSS 0.4%

Published 2024-06-07 · Affected: *

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the ‘course_id’ parameter in all versions up to, and including, 2.7.1 due to ins

CVE-2024-4223 UNKNOWN EPSS 0.4%

Published 2024-05-16 · Affected: *

The Tutor LMS plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on multiple functions in all versions up to, and i

CVE-2024-4318 UNKNOWN EPSS 0.4%

Published 2024-05-16 · Affected: *

The Tutor LMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘question_id’ parameter in versions up to, and including, 2.7.0 due to insufficient escaping on the user supplied p

CVE-2024-4279 UNKNOWN EPSS 0.3%

Published 2024-05-16 · Affected: *

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference to Arbitrary Course Deletion in versions up to, and including, 2.7.0 via the

CVE-2024-3553 UNKNOWN EPSS 0.4%

Published 2024-05-02 · Affected: *

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the hide_notices function in all versi

CVE-2024-3994 UNKNOWN EPSS 0.3%

Published 2024-04-25 · Affected: *

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tutor_instructor_list' shortcode in all versions up to, and inc

CVE-2024-1503 UNKNOWN EPSS 0.1%

Published 2024-03-21 · Affected: *

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.6.1. This is due to missing or incorrect n

CVE-2024-1502 UNKNOWN EPSS 0.4%

Published 2024-03-21 · Affected: *

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the tutor_delete_announcement() function in al

CVE-2024-1751 UNKNOWN EPSS 0.9%

Published 2024-03-13 · Affected: *

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the question_id parameter in all versions up to, and including, 2.6.1 due to ins

CVE-2024-1133 UNKNOWN EPSS 0.3%

Published 2024-02-29 · Affected: *

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized access of restricted Q&A content due to a missing capability check when interacting with questio

CVE-2024-1128 UNKNOWN EPSS 0.4%

Published 2024-02-29 · Affected: *

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 2.6.0. This is due to insufficient sanitization of HTML

Tutor LMS &#8211; eLearning and online course solution

Is Tutor LMS &#8211; eLearning and online course solution running on your site?

Tutor LMS – eLearning and online course solution

Is Tutor LMS – eLearning and online course solution running on your site?