CVE-2022-2563

CVE-2022-2563: Tutor LMS < 2.0.10 - Admin+ Stored Cross-Site Scripting

Vendor Unknown

Product Tutor LMS – eLearning and online course solution

Weakness CWE-79 · XSS

Published October 17, 2022

Last update May 13, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Tutor LMS WordPress plugin before 2.0.10 does not escape some course parameters, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Key dates

02Disclosure timeline

October 17, 2022 CVE published

May 13, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-2563 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2023-1743 SourceCodester Grade Point Average GPA Calculator index.php cross site scripting CVE-2024-13506 GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.97 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display_name Parameter CVE-2025-61636 Codex Special:Block vulnerable to message key XSS CVE-2024-20269 Cisco Firepower Management Center Software Cross-Site Scripting Vulnerability CVE-2020-3536 Cisco SD-WAN vManage Cross-Site Scripting Vulnerability