WordPress Plugin Vulnerabilities

Tutor LMS < 2.0.9 - Reflected Cross-Site Scripting

Description

The plugin does not escape an URL before outputting it back in an attribute, leading to Reflected Cross-Site Scripting

The issue was initially fixed in 1.9.13 but re-introduced in 2.0.0

Proof of Concept

Affects Plugins

Plugin icon
tutor
Fixed in 2.0.9

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Original Researcher
WPScan
Verified
Yes
WPVDB ID
53077bd4-4e30-43a9-97f0-349135242395

Timeline

Publicly Published
2022-08-22 (about 3 years ago)
Added
2022-08-22 (about 3 years ago)
Last Updated
2022-08-22 (about 3 years ago)

Other

Published
Title
Published
2023-01-23
Title
Image and Video Lightbox, Image PopUp < 2.1.6 - Admin+ Stored XSS
Published
2025-12-12
Title
Custom Frames <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Parameter
Published
2025-11-10
Title
Paypal Donation Shortcode <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2022-11-30
Title
All in One Time Clock Lite < 1.3.321 - Admin+ Stored XSS
Published
2024-05-14
Title
iframe < 5.1 - Contributor+ Stored XSS