DOM-Based Cross-Site Scripting Vulnerability in Tutor LMS Plugin for WordPress
CVE-2026-88963

6.1MEDIUM

Key Information:

Vendor

WordPress
Status
Tutor Lms – Elearning And Online Course Solution
Vendor
CVE Published:
16 October 2026

What is CVE-2026-88963?

The Tutor LMS plugin for WordPress is affected by a vulnerability that allows unauthenticated attackers to exploit the 'redirect_url' parameter due to inadequate input validation. This flaw resides in the Topbar component's back button handler, potentially permitting the injection of arbitrary web scripts. When users visit a page containing the malicious payload, these scripts execute in their browsers, raising significant security concerns for websites using the Tutor LMS plugin.

Affected Version(s)

Tutor LMS – eLearning and online course solution 0 <= 4.0.8

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset?reponame=&ne...
https://plugins.trac.wordpress.org/changeset/3700174/tuto...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sevada797
.