WordPress Plugin Vulnerabilities

Tutor LMS < 1.9.13 - Reflected Cross-Site Scripting

Description

The plugin does not escape some generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting

Proof of Concept

Affects Plugins

Plugin icon
tutor
Fixed in 1.9.13

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Original Researcher
WPScanTeam
Verified
Yes
WPVDB ID
3a9dbb3d-40d6-441a-a9b4-df9ae8c9e56b

Timeline

Publicly Published
2022-01-10 (about 4 years ago)
Added
2022-06-07 (about 3 years ago)
Last Updated
2022-06-07 (about 3 years ago)

Other

Published
Title
Published
2024-12-28
Title
PORTONE 우커머스 결제 < 3.2.6 - Reflected Cross-Site Scripting
Published
2025-06-05
Title
Next Event Calendar <= 1.2 - Authenticated (Author+) Stored Cross-Site Scripting
Published
2024-11-01
Title
Accordion title for Elementor < 1.2.2 - Authenticated (Author+) Stored Cross-Site Scripting
Published
2025-01-16
Title
WordPress File Search <= 1.2 - Reflected Cross-Site Scripting
Published
2010-12-07
Title
Twitter Feed < 1.0 - XSS