CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 2.6.0. This is due to insufficient sanitization of HTML input in the Q&A functionality. This makes it possible for authenticated attackers, with Student access and above, to inject arbitrary HTML onto a site, though it does not allow Cross-Site Scripting
Explanation of Vulnerability in Simple Terms
Tutor LMS versions up to 2.6.0 contain an input validation flaw that allows authenticated users to modify data or disrupt service. The vulnerability requires a valid user account but no special privileges. An attacker can alter course content, user records, or system settings, potentially affecting course integrity and availability for legitimate users.
What an attacker can do
Modify or delete course data and user information, or cause the site to become unavailable.
Potential impact on your site
Course content, student records, or site availability may be compromised by any registered user.
Conditions required to exploit
Attacker must have a valid user account on the site; no special role or admin access required.
Key dates
External resources
Related vulnerabilities
