Reflected Cross-Site Scripting Vulnerability in Tutor LMS by WordPress

CVE-2026-100193

What is CVE-2026-100193?

The Tutor LMS plugin for WordPress, used for eLearning and online course management, is susceptible to reflected cross-site scripting through the 'tab' parameter. This vulnerability arises from inadequate input sanitization and output escaping in all versions up to and including 4.1.0. Attackers can exploit this weakness by crafting malicious links that, when clicked by a user, result in the execution of arbitrary web scripts. The exploit is contingent on the lesson page having an empty nav-items array—typically occurring when the lesson lacks content, attachments, and has comments disabled, or the user is not logged in. This circumvents validation mechanisms, allowing raw, attacker-controlled inputs to affect the page.

References