Stored Cross-Site Scripting Vulnerability in Tutor LMS by WordPress
CVE-2026-93681
6.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 16 October 2026
What is CVE-2026-93681?
The Tutor LMS plugin for WordPress is affected by a vulnerability allowing authenticated attackers with subscriber-level access or higher to exploit the display_name parameter. Due to inadequate input sanitization and lack of proper output escaping, attackers can inject arbitrary web scripts into web pages. This malicious script executes whenever a user accesses an affected page. The exploitation necessitates the existence of a Legal Consent record linked to the attacker's account, thereby making the vulnerable View Logs functionality accessible.
Affected Version(s)
Tutor LMS – eLearning and online course solution 0 <= 4.1.0