Tutor LMS – eLearning and online course solution

Уязвимости

• CVE-2023-25700без авторизации≤ 2.1.10

  WordPress Tutor LMS Plugin <= 2.1.10 is vulnerable to SQL Injection

  Критич. 9.8

• CVE-2024-39645без авторизации · нужен клик≤ 2.7.2

  WordPress Tutor LMS plugin <= 2.7.2 - Cross Site Request Forgery (CSRF) vulnerability

  Высокий 8.8

• CVE-2026-78175подписчик+≤ 4.0.7

  Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution

  Высокий 8.8

• CVE-2025-6184нужен вход≤ 3.7.0

  Tutor LMS Pro – eLearning and online course solution <= 3.7.0 - Authenticated (Tutor Instructor+) SQL Injection

  Высокий 8.8

• CVE-2024-43142нужен вход≤ 2.7.3

  WordPress Tutor LMS plugin <= 2.7.3 - Broken Access Control vulnerability

  Высокий 8.8

• CVE-2023-25799нужен вход≤ 2.1.8

  WordPress Tutor LMS plugin <= 2.1.8 - Multiple Broken Access Control vulnerabilities

  Высокий 8.8

• CVE-2024-1751подписчик+≤ 2.6.1

  Tutor LMS – eLearning and online course solution <= 2.6.1 - Authenticated (Subscriber+) SQL Injection

  Высокий 8.8

• CVE-2023-25990нужен вход≤ 2.1.10

  WordPress Tutor LMS Plugin <= 2.1.10 is vulnerable to SQL Injection

  Высокий 8.8

• CVE-2023-25800нужен вход≤ 2.2.0

  WordPress Tutor LMS Plugin <= 2.2.0 is vulnerable to SQL Injection

  Высокий 8.8

• CVE-2026-1375нужен вход≤ 3.9.5

  Tutor LMS <= 3.9.5 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Course Modification and Deletion

  Высокий 8.1

• CVE-2025-58993высокие права≤ 3.7.4

  WordPress Tutor LMS Plugin <= 3.7.4 - SQL Injection Vulnerability

  Высокий 7.6

• CVE-2026-3360без авторизации≤ 3.9.7

  Tutor LMS <= 3.9.7 - Missing Authorization to Unauthenticated Arbitrary Billing Profile Overwrite via 'order_id' Parameter

  Высокий 7.5

• CVE-2025-13673без авторизации≤ 3.9.6

  Tutor LMS <= 3.9.6 - Unauthenticated SQL Injection via coupon_code

  Высокий 7.5

• CVE-2024-10400без авторизации≤ 2.7.6

  Tutor LMS <= 2.7.6 - Unauthenticated SQL Injection via rating_filter

  Высокий 7.5

• CVE-2023-3133без авторизации→ 2.2.1

  Tutor LMS < 2.2.1 - Unauthenticated Access to Tutor LMS Lesson Resources via REST API

  Высокий 7.5

• CVE-2024-43282высокие права≤ 2.7.2

  WordPress Tutor LMS plugin <= 2.7.2 - SQL Injection vulnerability

  Высокий 7.2

• CVE-2024-37266высокие права≤ 2.7.1

  WordPress Tutor LMS plugin <= 2.7.1 - Path Traversal vulnerability

  Высокий 7.2

• CVE-2024-37256высокие права≤ 2.7.1

  WordPress Tutor LMS plugin <= 2.7.1 - SQL Injection vulnerability

  Высокий 7.2

• CVE-2024-4902админ≤ 2.7.1

  Tutor LMS – eLearning and online course solution <= 2.7.1 -Authenticated (Administrator+) SQL Injection

  Высокий 7.2

• CVE-2026-16759без авторизации≤ 4.0.5

  Tutor LMS <= 4.0.5 - Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters

  Средний 6.5

• CVE-2026-40743без авторизации≤ 3.9.7

  WordPress Tutor LMS plugin <= 3.9.7 - Broken Access Control vulnerability

  Средний 6.5

• CVE-2024-3553без авторизации≤ 2.6.2

  Tutor LMS <= 2.6.2 - Missing Authorization to Unauthenticated Limited Options Update

  Средний 6.5

• CVE-2026-89333подписчик+≤ 4.0.8

  Tutor LMS <= 4.0.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameter

  Средний 6.5

• CVE-2026-15022подписчик+≤ 4.0.0

  Tutor LMS <= 4.0.0 - Authenticated (Subscriber+) SQL Injection via Stored Quiz Answer Array

  Средний 6.5

• CVE-2026-57694нужен вход≤ 3.9.13

  WordPress Tutor LMS plugin <= 3.9.13 - Insecure Direct Object References (IDOR) vulnerability

  Средний 6.5

• CVE-2025-32223нужен вход≤ 3.9.4

  WordPress Tutor LMS plugin <= 3.9.4 - Insecure Direct Object References (IDOR) vulnerability

  Средний 6.5

• CVE-2026-23799нужен вход≤ 3.9.5

  WordPress Tutor LMS plugin <= 3.9.5 - Broken Access Control vulnerability

  Средний 6.5

• CVE-2025-13679подписчик+≤ 3.9.3

  Tutor LMS <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via tutor_order_details

  Средний 6.5

• CVE-2024-4318нужен вход≤ 2.7.0

  Tutor LMS <= 2.7.0 - Authenticated (Instructor+) SQL Injection

  Средний 6.5

• CVE-2024-4279нужен вход≤ 2.7.0

  Tutor LMS – eLearning and online course solution <= 2.7.0 - Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Course Deletion

  Средний 6.5

• CVE-2026-6080админ≤ 3.9.8

  Tutor LMS <= 3.9.8 - Authenticated (Admin+) SQL Injection via 'date' Parameter

  Средний 6.5

• CVE-2026-13443автор+≤ 3.9.13

  Tutor LMS <= 3.9.13 - Authenticated (Author+) Stored Cross-Site Scripting via Lesson Attachment Title

  Средний 6.4

• CVE-2026-89081без авторизации · нужен клик≤ 4.0.8

  Tutor LMS <= 4.0.8 - Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters

  Средний 6.1

• CVE-2021-24873без авторизации · нужен клик→ 1.9.11

  Tutor LMS < 1.9.11 - Reflected Cross-Site Scripting

  Средний 6.1

• CVE-2026-40740нужен вход≤ 3.9.7

  WordPress Tutor LMS plugin <= 3.9.7 - Broken Access Control vulnerability

  Средний 5.4

• CVE-2026-3358подписчик+≤ 3.9.7

  Tutor LMS <= 3.9.7 - Missing Authorization to Authenticated (Subscriber+) Unauthorized Private Course Enrollment

  Средний 5.4

• CVE-2026-0548подписчик+≤ 3.9.4

  Tutor LMS – eLearning and online course solution <= 3.9.4 - Missing Authorization to Authenticated (Subscriber+) Limited Attachment Deletion

  Средний 5.4

• CVE-2025-6639подписчик+≤ 3.8.3

  Tutor LMS Pro – eLearning and online course solution <= 3.8.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to View/Edit Other Assignments

  Средний 5.4

• CVE-2024-43231нужен вход≤ 2.7.3

  WordPress Tutor LMS plugin <= 2.7.3 - Cross Site Scripting (XSS) vulnerability

  Средний 5.4

• CVE-2024-3994участник+≤ 2.6.2

  Tutor LMS – eLearning and online course solution <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tutor_instructor_list' Shortcode

  Средний 5.4

• CVE-2025-11564без авторизации≤ 3.8.3

  Tutor LMS – eLearning and online course solution <= 3.8.3 - Missing Authorization to Unauthenticated Payment Status Update

  Средний 5.3

• CVE-2024-10393без авторизации≤ 2.7.6

  Tutor LMS <= 2.7.6 - User Registration Setting Bypass to Unauthorized User Registration

  Средний 5.3

• CVE-2026-6965нужен вход≤ 3.9.9

  Tutor LMS <= 3.9.9 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Post Deletion via 'course' GET Parameter

  Средний 5.3

• CVE-2026-5502подписчик+≤ 3.9.8

  Tutor LMS <= 3.9.8 - Authenticated (Subscriber+) Arbitrary Course Content Manipulation via tutor_update_course_content_order

  Средний 5.3

• CVE-2026-1371подписчик+≤ 3.9.5

  Tutor LMS <= 3.9.5 - Authenticated (Subscriber+) Information Disclosure in Coupon Details via 'tutor_coupon_details' AJAX Action

  Средний 5.3

• CVE-2026-15444админ≤ 4.0.1

  Tutor LMS <= 4.0.1 - Authenticated (Administrator+) SQL Injection via 'coupon_code' Parameter

  Средний 4.9

• CVE-2026-10736админ≤ 3.9.11

  Tutor LMS <= 3.9.11 - Authenticated (Administrator+) SQL Injection via 'data' Parameter

  Средний 4.9

• CVE-2024-37947высокие права≤ 2.7.2

  WordPress Tutor LMS plugin <= 2.7.2 - Cross Site Scripting (XSS) vulnerability

  Средний 4.8

• CVE-2023-49829высокие права≤ 2.2.4

  WordPress Tutor LMS Plugin <= 2.2.4 is vulnerable to Cross Site Scripting (XSS)

  Средний 4.8

• CVE-2023-2919без авторизации · нужен клик≤ 2.7.4

  Tutor LMS <= 2.7.4 - Cross-Site Request Forgery via 'addon_enable_disable'

  Средний 4.3

• CVE-2024-1503без авторизации · нужен клик≤ 2.6.1

  Tutor LMS – eLearning and online course solution <= 2.6.1 - Cross-Site Request Forgery to Plugin Deactivation and Data Erase

  Средний 4.3

• CVE-2026-18439нужен вход≤ 4.0.7

  Tutor LMS <= 4.0.7 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via 'payload' Paramete

  Средний 4.3

• CVE-2026-88944подписчик+≤ 4.0.8

  Tutor LMS <= 4.0.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id' Parameter

  Средний 4.3

• CVE-2026-3371подписчик+≤ 3.9.7

  Tutor LMS <= 3.9.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Course Content Modification

  Средний 4.3

• CVE-2025-13935подписчик+≤ 3.9.2

  Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Course Completion

  Средний 4.3

• CVE-2025-13934подписчик+≤ 3.9.3

  Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Course Enrollment Bypass

  Средний 4.3

• CVE-2025-13628подписчик+≤ 3.9.3

  Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Coupon Modification

  Средний 4.3

• CVE-2025-6680нужен вход≤ 3.8.3

  Tutor LMS <= 3.8.3 - Missing Authorization to Sensitive Information Exposure

  Средний 4.3

• CVE-2025-32230нужен вход≤ 3.4.0

  WordPress Tutor LMS plugin <= 3.4.0 - HTML Injection vulnerability

  Средний 4.3

• CVE-2024-5438нужен вход≤ 2.7.1

  Tutor LMS – eLearning and online course solution <= 2.7.1 - Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Quiz Attempt Deletion

  Средний 4.3

• CVE-2024-1502подписчик+≤ 2.6.1

  Tutor LMS – eLearning and online course solution <= 2.6.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion

  Средний 4.3

• CVE-2024-1133подписчик+≤ 2.6.0

  Tutor LMS <= 2.6.0 - Missing Authorization

  Средний 4.3

• CVE-2025-47555высокие права≤ 3.9.4

  WordPress Tutor LMS plugin <= 3.9.4 - Insecure Direct Object References (IDOR) vulnerability

  Низкий 3.8

• CVE-2024-1128нужен вход≤ 2.6.0

  Tutor LMS <= 2.6.0 - Authenticated(Student+) HTML Injection via Q&A

  Низкий 3.5