| 2026-10-16 |
WPSEC-2026-1061 |
Tutor LMS <= 4.1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name in Consent Logs |
Medium 6.4 |
4.1.3 |
| 2026-10-07 |
WPSEC-2026-0519 |
Tutor LMS <= 4.1.0 - Authenticated (Tutor Instructor+) Stored Cross-Site Scripting via Quiz Question Feedback |
Medium 6.4 |
4.1.1 |
| 2026-10-07 |
WPSEC-2026-0518 |
Tutor LMS <= 4.1.0 - Unauthenticated Missing Authorization via Page Regeneration Action |
Medium 5.3 |
4.1.1 |
| 2026-10-07 |
WPSEC-2026-0517 |
Tutor LMS <= 4.1.0 - Unauthenticated Reflected Cross-Site Scripting via 'tab' Parameter |
Medium 4.7 |
4.1.1 |
| 2026-10-07 |
WPSEC-2026-0516 |
Tutor LMS <= 4.1.0 - Authenticated (Tutor Instructor+) Insecure Direct Object Reference to Arbitrary Post Overwrite via Course Creation 'ID' Parameter |
Medium 5.4 |
4.1.1 |
| 2026-10-07 |
WPSEC-2026-0515 |
Tutor LMS <= 4.1.0 - Authenticated (Subscriber+) Insecure Direct Object Reference to Quiz Grade Manipulation via Quiz Attempt Submission |
Medium 4.3 |
4.1.1 |
| 2026-10-07 |
WPSEC-2026-0514 |
Tutor LMS <= 4.1.0 - Authenticated (Tutor Instructor+) Stored Cross-Site Scripting via Quiz Layout Setting |
Medium 6.4 |
4.1.1 |
| 2026-10-02 |
WPSEC-2026-0263 |
Tutor LMS <= 4.0.9 - Unauthenticated Insecure Direct Object Reference to Quiz Attempt Disclosure via 'attempt_id' Parameter |
Medium 5.3 |
4.1.0 |
