WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
tutor
Published
2026-04-10
Title
Tutor LMS < 3.9.8 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Course Content Modification
Slug
tutor
Published
2026-04-16
Title
Tutor LMS < 3.9.9 - Authenticated (Admin+) SQL Injection via 'date' Parameter
Slug
tutor
Published
2026-04-16
Title
Tutor LMS < 3.9.9 - Authenticated (Subscriber+) Arbitrary Course Content Manipulation via tutor_update_course_content_order
Slug
tutor
Published
2026-04-20
Title
Tutor LMS – eLearning and online course solution < 3.9.8 - Missing Authorization
Slug
tutor
Published
2026-03-15
Title
Tutor LMS < 3.9.8 - Missing Authorization
Slug
tutor
Published
2026-05-12
Title
Tutor LMS < 3.9.10 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Post Deletion via 'course' GET Parameter
Slug
tutor
Published
2026-06-17
Title
Tutor LMS < 3.9.12 - Authenticated (Administrator+) SQL Injection via 'data' Parameter
Slug
tutor
Published
2026-06-22
Title
Tutor LMS < 3.9.13 - Subscriber+ Arbitrary Auto-Approved Comment Creation
Slug
tutor
Published
2026-06-22
Title
Tutor LMS < 3.9.13 - Instructor+ Arbitrary Post Overwrite via IDOR
Slug
tutor
Published
2026-06-22
Title
Tutor LMS < 3.9.13 - Subscriber+ Arbitrary Quiz Attempt Modification via IDOR
Slug
tutor
Published
2026-06-30
Title
Tutor LMS < 3.9.14 - Authenticated (Author+) Stored Cross-Site Scripting via Lesson Attachment Title
Slug
tutor
Published
2026-06-22
Title
Tutor LMS < 3.9.13 - Subscriber+ Unauthorized Course Enrollment and Private Course Content Disclosure via Droip/Kirki Integration
Slug
tutor
Published
2026-07-02
Title
Tutor LMS < 3.9.14 - Subscriber+ Paid Course Content Disclosure via Enrollment Check Bypass
Slug
tutor
Published
2026-07-13
Title
Tutor LMS < 4.0.0 - Subscriber+ Cross-Course Q&A Content Disclosure and Reply Injection
Slug
tutor
Published
2026-07-15
Title
Tutor LMS < 4.0.1 - Authenticated (Subscriber+) SQL Injection via Stored Quiz Answer Array
Slug
tutor
Published
2026-07-06
Title
Tutor LMS – eLearning and online course solution < 3.9.14 - Unauthenticated Insecure Direct Object Reference
Slug
tutor
Published
2026-07-27
Title
Tutor LMS < 4.0.2 - Authenticated (Administrator+) SQL Injection via 'coupon_code' Parameter
Slug
tutor
Published
2026-08-20
Title
Tutor LMS < 4.0.6 - Instructor+ Cross-Instructor Private Course Disclosure via IDOR
Slug
tutor
Published
2026-08-20
Title
Tutor LMS < 4.0.6 - Instructor+ Arbitrary File Read via Video Path
Slug
tutor
Published
2026-08-24
Title
Tutor LMS < 4.0.6 - Unauthenticated SQLi via 'offset' and 'item_per_page' Parameters
Slug
tutor
Published
2026-08-26
Title
Tutor LMS < 4.0.6 - Unauthenticated Arbitrary Zero-Argument Function Invocation via Template Variable Shadowing
Slug
tutor
Published
2026-09-18
Title
Tutor LMS < 4.0.9 - Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters
Slug
tutor
Published
2026-09-11
Title
Tutor LMS < 4.0.8 - Subscriber+ PHP Object Injection via withdraw_method_field Parameter
Slug
tutor
Published
2026-09-14
Title
Tutor LMS 4.0.0 - < 4.0.8 - Subscriber+ Cross-Course Lesson Comment Disclosure
Slug
tutor
Published
2026-09-14
Title
Tutor LMS 2.7.1 - < 4.0.8 - Read-Only API Key Privilege Escalation via REST Request Misclassification