WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
tutor
Published
2026-01-07
Title
Tutor LMS < 3.9.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via tutor_order_details
Slug
tutor
Published
2026-01-08
Title
Tutor LMS – eLearning and online course solution < 3.9.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Coupon Modification
Slug
tutor
Published
2026-01-08
Title
Tutor LMS – eLearning and online course solution < 3.9.4 - Missing Authorization to Authenticated (Subscriber+) Course Enrollment Bypass
Slug
tutor
Published
2026-01-08
Title
Tutor LMS – eLearning and online course solution < 3.9.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Course Completion
Slug
tutor
Published
2026-01-20
Title
Tutor LMS – eLearning and online course solution < 3.9.5 - Missing Authorization to Authenticated (Subscriber+) Limited Attachment Deletion
Slug
tutor
Published
2026-02-02
Title
Tutor LMS < 3.9.6 - Authenticated (Subscriber+) Information Disclosure in Coupon Details via 'tutor_coupon_details' AJAX Action
Slug
tutor
Published
2026-02-02
Title
Tutor LMS < 3.9.6 - Instructor+ Arbitrary Course Modification and Deletion via IDOR
Slug
tutor
Published
2026-01-02
Title
Tutor LMS < 3.9.5 - Authenticated (Instructor+) Insecure Direct Object Reference
Slug
tutor
Published
2026-02-27
Title
Tutor LMS < 3.9.7 - Unauthenticated SQL Injection via coupon_code
Slug
tutor
Published
2026-02-25
Title
Tutor LMS – eLearning and online course solution < 3.9.6 - Missing Authorization
Slug
tutor
Published
2026-03-16
Title
Tutor LMS – eLearning and online course solution < 3.9.5 - Authenticated (Subscriber+) Insecure Direct Object Reference
Slug
tutor
Published
2026-04-09
Title
Tutor LMS < 3.9.8 - Unauthenticated Arbitrary Billing Profile Overwrite via 'order_id'
Slug
tutor
Published
2026-04-10
Title
Tutor LMS < 3.9.8 - Missing Authorization to Authenticated (Subscriber+) Unauthorized Private Course Enrollment
Slug
tutor
Published
2026-04-10
Title
Tutor LMS < 3.9.8 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Course Content Modification
Slug
tutor
Published
2026-04-16
Title
Tutor LMS < 3.9.9 - Authenticated (Admin+) SQL Injection via 'date' Parameter
Slug
tutor
Published
2026-04-16
Title
Tutor LMS < 3.9.9 - Authenticated (Subscriber+) Arbitrary Course Content Manipulation via tutor_update_course_content_order
Slug
tutor
Published
2026-04-20
Title
Tutor LMS – eLearning and online course solution < 3.9.8 - Missing Authorization
Slug
tutor
Published
2026-03-15
Title
Tutor LMS < 3.9.8 - Missing Authorization
Slug
tutor-lms-bunnynet-integration
Published
2026-01-19
Title
Tutor LMS BunnyNet Integration < 1.0.1 - Authenticated (Tutor instructor+) Stored Cross-Site Scripting
Slug
tutor-lms-elementor-addons
Published
2024-03-25
Title
Tutor LMS Elementor Addons < 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
tutor-lms-elementor-addons
Published
2024-08-19
Title
Tutor LMS Elementor Addons < 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Course Carousel Widget
Slug
tutor-lms-elementor-addons
Published
2024-11-14
Title
Tutor LMS Elementor Addons < 2.1.6 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation
Slug
tutor-lms-elementor-addons
Published
2024-12-02
Title
Tutor LMS Elementor Addons < 2.1.6 - Missing Authorization
Slug
tutor-lms-elementor-addons
Published
2025-11-30
Title
Tutor LMS Elementor Addons < 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
tutor-lms-migration-tool
Published
2024-07-26
Title
Tutor LMS – Migration Tool <= 2.2.2 - Missing Authorization in tutor_import_from_xml