CVE-2025-32230 MEDIUM

CVE-2025-32230: WordPress Tutor LMS plugin <= 3.4.0 - HTML Injection vulnerability

Vendor Themeum
Product Tutor LMS
Weakness CWE-80 · XSS · basic
Published April 10, 2025
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Themeum Tutor LMS tutor.This issue affects Tutor LMS: from n/a through <= 3.4.0.

Explanation of Vulnerability in Simple Terms

02Summary

Tutor LMS versions 3.4.0 and earlier contain an input validation flaw that allows authenticated users to modify data they should not have access to. The vulnerability requires a valid user account but no special privileges. An attacker can alter information through the web interface, though the impact is limited to data integrity within the application.

What an attacker can do

03Attacker Capabilities

Modify data or content in the LMS that the attacker should not be able to change.

Potential impact on your site

04Site Impact

Student or instructor accounts could alter grades, course content, or other LMS records without authorization.

Conditions required to exploit

05Prerequisites

Attacker must have a valid user account on the site; no special privileges required.

Key dates

06Disclosure timeline

April 10, 2025 CVE published
April 28, 2026 Record updated