# Tutor LMS – eLearning and online course solution

> A complete WordPress LMS plugin to create any eLearning website easily.

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-13 09:30 UTC.

## Facts (WordPress.org)

- Slug: `tutor`
- Author: Themeum
- Version: 4.2.1
- Active installs: 90,000+
- Last update: 2026-11-09 (4 days ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 5.3, PHP 7.4
- Tags: course, education, elearning, learning management system, lms
- Page: https://wordpress.org/plugins/tutor/

## Checks (against WordPress 7.1.4)

- OK: Updated 4 days ago.
- OK: Tested with WordPress 7.1.
- OK: Runs on any PHP WordPress supports (PHP 7.4+).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Locked in ↔ Portable, Slow ↔ Responsive, Steep ↔ Easy, Vague docs ↔ Clear docs, Behind ↔ Current, Heavy ↔ Light.

## Known vulnerabilities

- 2026-11-06 MEDIUM: Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via REST API Endpoints (up to 4.1.2). CVE-2026-93779, https://www.wordfence.com/threat-intel/vulnerabilities/id/b0c8b586-784e-43a4-8bb8-c7cb771476a4?source=api-prod
- 2026-11-05 MEDIUM: Authenticated (Subscriber+) Information Exposure (1.6.4 to 4.1.3). CVE-2026-85570, https://www.wordfence.com/threat-intel/vulnerabilities/id/1ad22035-c971-4ce6-af4b-c78aa8a54f6a?source=api-prod
- 2026-10-19 MEDIUM: Authenticated (Subscriber+) Stored Cross-Site Scripting (up to 4.1.2). CVE-2026-111407, https://www.wordfence.com/threat-intel/vulnerabilities/id/464d7191-4afd-48c4-8d2e-655ee7375ff1?source=api-prod
- 2026-10-17 MEDIUM: Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover via 'ID' Parameter (up to 4.1.0). CVE-2026-92715, https://www.wordfence.com/threat-intel/vulnerabilities/id/12f093bd-5230-4103-b571-80543c1b43cf?source=api-prod
- 2026-10-16 MEDIUM: Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting via 'redirect_url' Parameter (up to 4.0.8). CVE-2026-88963, https://www.wordfence.com/threat-intel/vulnerabilities/id/f39a9570-a352-45f3-8644-2de2c1c709d2?source=api-prod
- 2026-10-16 MEDIUM: Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name Parameter (up to 4.1.0). CVE-2026-93681, https://www.wordfence.com/threat-intel/vulnerabilities/id/3ff5cff8-ecca-4cde-b3f6-09ee49afea25?source=api-prod
- 2026-10-15 MEDIUM: Missing Authorization (up to 4.1.0). CVE-2026-96537, https://www.wordfence.com/threat-intel/vulnerabilities/id/6d50b3dd-2c4b-428b-9d82-f8cc65d6ba1f?source=api-prod
- 2026-10-14 MEDIUM: Reflected Cross-Site Scripting via 'tab' Parameter (up to 4.1.0). CVE-2026-100193, https://www.wordfence.com/threat-intel/vulnerabilities/id/4322fce1-0403-4458-82e3-7d374ab724c9?source=api-prod
- 2026-10-10 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 4.1.0). CVE-2026-42702, https://www.wordfence.com/threat-intel/vulnerabilities/id/4ce64a1f-0af9-475b-80a4-87d35a947c2e?source=api-prod
- 2026-10-10 MEDIUM: Authenticated (Instructor+) Insecure Direct Object Reference (4.0.5 to 4.1.0). CVE-2026-85571, https://www.wordfence.com/threat-intel/vulnerabilities/id/16323cea-92f2-4c85-a6b2-dad476d3538f?source=api-prod
- 2026-10-08 MEDIUM: Authenticated (Subscriber+) Race Condition (up to 4.1.2). CVE-2026-42698, https://www.wordfence.com/threat-intel/vulnerabilities/id/238be5d8-8987-4ab0-ae8c-b07794d55bbe?source=api-prod
- 2026-09-22 MEDIUM: Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via 'payload' Parameter (up to 4.0.7). CVE-2026-18439, https://www.wordfence.com/threat-intel/vulnerabilities/id/6d07c82d-262a-4ac1-9ee5-7ef4d025f66f?source=api-prod
- 2026-09-19 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id' Parameter (up to 4.0.8). CVE-2026-88944, https://www.wordfence.com/threat-intel/vulnerabilities/id/7e23fcd0-62b4-460d-9b64-8adbf14bf820?source=api-prod
- 2026-09-19 MEDIUM: Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters (up to 4.0.8). CVE-2026-89081, https://www.wordfence.com/threat-intel/vulnerabilities/id/dcffa961-f670-494d-874c-50538038b915?source=api-prod
- 2026-09-19 MEDIUM: Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameter (up to 4.0.8). CVE-2026-89333, https://www.wordfence.com/threat-intel/vulnerabilities/id/244051ef-5357-4b16-b690-46c8fea56847?source=api-prod
- 2026-09-16 MEDIUM: REST API Authentication Confusion (up to 4.0.7). CVE-2026-85569, https://www.wordfence.com/threat-intel/vulnerabilities/id/2aeb5f28-00d3-45f3-846f-01ba99c959af?source=api-prod
- 2026-09-16 MEDIUM: Authenticated (Subscriber+) Information Exposure (up to 4.0.7). CVE-2026-85572, https://www.wordfence.com/threat-intel/vulnerabilities/id/98d9b95f-7ea5-4650-8a19-0b257efdf776?source=api-prod
- 2026-09-12 HIGH: Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution (up to 4.0.7). CVE-2026-78175, https://www.wordfence.com/threat-intel/vulnerabilities/id/d0077d56-11e7-4e74-abe0-63e81db67be3?source=api-prod
- 2026-08-28 MEDIUM: Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters (up to 4.0.5). CVE-2026-16759, https://www.wordfence.com/threat-intel/vulnerabilities/id/65f68a49-8ded-479f-a9c3-187703bfae65?source=api-prod
- 2026-08-27 CRITICAL: Unauthenticated Arbitrary Zero-Argument Function Invocation (up to 4.0.5). CVE-2026-19092, https://www.wordfence.com/threat-intel/vulnerabilities/id/37848512-fbdf-48cd-9d59-5bfb1bdbe73d?source=api-prod
- 2026-08-26 HIGH: Unauthenticated SQL Injection (before 4.0.6). CVE-2026-19094, https://www.wordfence.com/threat-intel/vulnerabilities/id/1fed22d4-8526-429c-950b-c5affe108a93?source=api-prod
- 2026-08-22 MEDIUM: Authenticated (Instructor+) Insecure Direct Object Reference (up to 4.0.5). CVE-2026-14187, https://www.wordfence.com/threat-intel/vulnerabilities/id/d9c95fe9-f4c0-40c1-a733-ebbe9898e27d?source=api-prod
- 2026-08-22 MEDIUM: Authenticated (Custom Role+) Arbitrary File Read (before 4.0.6). CVE-2026-19093, https://www.wordfence.com/threat-intel/vulnerabilities/id/9d38ac39-1005-495f-8947-81da35ff4092?source=api-prod
- 2026-08-06 MEDIUM: Authenticated (Subscriber+) Information Exposure (up to 3.9.13). CVE-2026-14306, https://www.wordfence.com/threat-intel/vulnerabilities/id/1d3cc32b-e415-4350-811a-c799a6ec24b6?source=api-prod
- 2026-07-30 MEDIUM: Missing Authorization (before 4.0.0). CVE-2026-14310, https://www.wordfence.com/threat-intel/vulnerabilities/id/b75789ff-6050-4044-a3ff-d071591b4ec6?source=api-prod
- 2026-07-28 MEDIUM: Authenticated (Administrator+) SQL Injection via 'coupon_code' Parameter (up to 4.0.1). CVE-2026-15444, https://www.wordfence.com/threat-intel/vulnerabilities/id/9d637d7b-7a47-40db-a931-ec7ca723dfab?source=api-prod
- 2026-07-16 MEDIUM: Authenticated (Subscriber+) SQL Injection via Stored Quiz Answer Array (up to 4.0.0). CVE-2026-15022, https://www.wordfence.com/threat-intel/vulnerabilities/id/8cd603aa-c4d4-488c-b134-6983240c3a18?source=api-prod
- 2026-07-13 MEDIUM: Unauthenticated Insecure Direct Object Reference (up to 3.9.13). CVE-2026-57694, https://www.wordfence.com/threat-intel/vulnerabilities/id/601ac722-a2d4-4dce-9cde-dd3f4c15416a?source=api-prod
- 2026-07-13 MEDIUM: Authenticated (Subscriber+) Insecure Direct Object Reference to Quiz Attemp Modification (up to 3.9.12). CVE-2026-12271, https://www.wordfence.com/threat-intel/vulnerabilities/id/fa9a8227-6e2a-4375-9672-20290ece292c?source=api-prod
- 2026-07-13 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Comment Creation (up to 3.9.12). CVE-2026-12273, https://www.wordfence.com/threat-intel/vulnerabilities/id/c4b01e7d-1c6d-4252-95a4-13f4e486b643?source=api-prod
- 2026-07-13 MEDIUM: Authenticated (Subscriber+) Information Disclosure (up to 3.9.12). CVE-2026-12275, https://www.wordfence.com/threat-intel/vulnerabilities/id/b37ee395-aad8-4908-b3f7-c9f68ed4a4e6?source=api-prod
- 2026-07-01 MEDIUM: Authenticated (Author+) Stored Cross-Site Scripting via Lesson Attachment Title (up to 3.9.13). CVE-2026-13443, https://www.wordfence.com/threat-intel/vulnerabilities/id/7483762c-5356-4844-90a9-511d9ec48625?source=api-prod
- 2026-06-18 MEDIUM: Authenticated (Administrator+) SQL Injection via 'data' Parameter (up to 3.9.11). CVE-2026-10736, https://www.wordfence.com/threat-intel/vulnerabilities/id/1e193bb9-bb16-4a77-877b-fa0ab29a6c74?source=api-prod
- 2026-06-15 MEDIUM: Missing Authorization (up to 3.9.7). CVE-2026-40743, https://www.wordfence.com/threat-intel/vulnerabilities/id/e4482f92-024d-402d-9cf3-c4709f23baf0?source=api-prod
- 2026-05-13 MEDIUM: Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Post Deletion via 'course' GET Parameter (up to 3.9.9). CVE-2026-6965, https://www.wordfence.com/threat-intel/vulnerabilities/id/55924ea3-373c-4297-a958-5670def1f6c0?source=api-prod
- 2026-04-17 MEDIUM: Authenticated (Subscriber+) Arbitrary Course Content Manipulation via tutor_update_course_content_order (up to 3.9.8). CVE-2026-5502, https://www.wordfence.com/threat-intel/vulnerabilities/id/f32ae42d-dd1f-41d7-8ae4-ddec56d78ae6?source=api-prod
- 2026-04-17 MEDIUM: Authenticated (Admin+) SQL Injection via 'date' Parameter (up to 3.9.8). CVE-2026-6080, https://www.wordfence.com/threat-intel/vulnerabilities/id/6dd041ff-a0a3-4d1f-83e0-6ec2a978e9cf?source=api-prod
- 2026-04-15 MEDIUM: Missing Authorization (up to 3.9.7). CVE-2026-40740, https://www.wordfence.com/threat-intel/vulnerabilities/id/6625dcea-13cc-4c08-9361-946638bf6678?source=api-prod
- 2026-04-11 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Unauthorized Private Course Enrollment (up to 3.9.7). CVE-2026-3358, https://www.wordfence.com/threat-intel/vulnerabilities/id/0c173356-7228-4253-bb28-2c2e11af76fd?source=api-prod
- 2026-04-11 MEDIUM: Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Course Content Modification (up to 3.9.7). CVE-2026-3371, https://www.wordfence.com/threat-intel/vulnerabilities/id/f9cf0430-8577-449a-aefe-d7bf606fe2de?source=api-prod
- 2026-04-10 HIGH: Missing Authorization to Unauthenticated Arbitrary Billing Profile Overwrite via 'order_id' Parameter (up to 3.9.7). CVE-2026-3360, https://www.wordfence.com/threat-intel/vulnerabilities/id/7f365519-dd0a-4f39-880d-7216ce2f7d1e?source=api-prod
- 2026-03-16 MEDIUM: Authenticated (Subscriber+) Insecure Direct Object Reference (up to 3.9.4). CVE-2025-32223, https://www.wordfence.com/threat-intel/vulnerabilities/id/b6f7c4c8-210f-4bbb-8352-5c2e550e44c3?source=api-prod
- 2026-02-27 HIGH: Unauthenticated SQL Injection via coupon_code (up to 3.9.6). CVE-2025-13673, https://www.wordfence.com/threat-intel/vulnerabilities/id/007df869-dacb-4b0a-9c98-50586934cdab?source=api-prod
- 2026-02-25 MEDIUM: Missing Authorization (up to 3.9.5). CVE-2026-23799, https://www.wordfence.com/threat-intel/vulnerabilities/id/24009534-3a57-4ed3-b841-72e87e2a6925?source=api-prod
- 2026-02-02 HIGH: Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Course Modification and Deletion (up to 3.9.5). CVE-2026-1375, https://www.wordfence.com/threat-intel/vulnerabilities/id/4e95b32b-c050-41eb-8fce-461257420eb6?source=api-prod
- 2026-02-02 MEDIUM: Authenticated (Subscriber+) Information Disclosure in Coupon Details via 'tutor_coupon_details' AJAX Action (up to 3.9.5). CVE-2026-1371, https://www.wordfence.com/threat-intel/vulnerabilities/id/7f5c5f64-a864-4ce1-9080-19f7c4418307?source=api-prod
- 2026-01-20 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Limited Attachment Deletion (up to 3.9.4). CVE-2026-0548, https://www.wordfence.com/threat-intel/vulnerabilities/id/0e475e02-494a-4ad0-a83c-d027c3a32989?source=api-prod
- 2026-01-08 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Arbitrary Coupon Modification (up to 3.9.3). CVE-2025-13628, https://www.wordfence.com/threat-intel/vulnerabilities/id/46f71f7b-7326-47b6-a23a-68a40f5bb56b?source=api-prod
- 2026-01-08 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Course Enrollment Bypass (up to 3.9.3). CVE-2025-13934, https://www.wordfence.com/threat-intel/vulnerabilities/id/5de212c9-5c2e-4713-b1ce-022dd84520c3?source=api-prod
- 2026-01-08 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Arbitrary Course Completion (up to 3.9.2). CVE-2025-13935, https://www.wordfence.com/threat-intel/vulnerabilities/id/7b8b111a-9626-41f4-8a13-51f576af0257?source=api-prod
- 2026-01-07 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via tutor_order_details (up to 3.9.3). CVE-2025-13679, https://www.wordfence.com/threat-intel/vulnerabilities/id/0830d0c3-99c0-423e-99ab-f0c1cbec52d9?source=api-prod
- 2026-01-02 MEDIUM: Authenticated (Instructor+) Insecure Direct Object Reference (up to 3.9.4). CVE-2025-47555, https://www.wordfence.com/threat-intel/vulnerabilities/id/5849a9f6-715e-4ac8-a0f7-1cd0814fff58?source=api-prod
- 2025-10-24 MEDIUM: Missing Authorization to Sensitive Information Exposure (up to 3.8.3). CVE-2025-6680, https://www.wordfence.com/threat-intel/vulnerabilities/id/1b8d88e4-a9dc-4740-b836-99f730beefcb?source=api-prod
- 2025-10-24 MEDIUM: Missing Authorization to Unauthenticated Payment Status Update (up to 3.8.3). CVE-2025-11564, https://www.wordfence.com/threat-intel/vulnerabilities/id/26289a93-063b-469a-9d09-c286d76fce0c?source=api-prod
- 2025-09-09 MEDIUM: Authenticated (Administrator+) SQL Injection (up to 3.7.4). CVE-2025-58993, https://www.wordfence.com/threat-intel/vulnerabilities/id/91ca027c-0483-44de-b19e-243ccb2c7b31?source=api-prod
- 2025-04-07 MEDIUM: Authenticated (Subscriber+) HTML Injection (up to 3.4.0). CVE-2025-32230, https://www.wordfence.com/threat-intel/vulnerabilities/id/c191da68-d531-4c01-a364-2621c822dc80?source=api-prod
- 2024-11-20 HIGH: Unauthenticated SQL Injection via rating_filter (up to 2.7.6). CVE-2024-10400, https://www.wordfence.com/threat-intel/vulnerabilities/id/bcf37d4e-e94a-4046-9949-c208e4e70197?source=api-prod
- 2024-11-20 MEDIUM: User Registration Setting Bypass to Unauthorized User Registration (up to 2.7.6). CVE-2024-10393, https://www.wordfence.com/threat-intel/vulnerabilities/id/bf8aa169-df51-46db-8c65-f1543d4f75f9?source=api-prod
- 2024-09-09 MEDIUM: Cross-Site Request Forgery via 'addon_enable_disable' (up to 2.7.4). CVE-2023-2919, https://www.wordfence.com/threat-intel/vulnerabilities/id/992abd72-2a8e-4bda-94c2-4a7f88487906?source=api-prod
- 2024-08-16 HIGH: Authenticated (Administrator+) SQL Injection (up to 2.7.2). CVE-2024-43282, https://www.wordfence.com/threat-intel/vulnerabilities/id/839b68e6-0462-4f88-ac13-ed4b69887d6b?source=api-prod
- 2024-08-09 MEDIUM: Authenticated (Instructor+) Stored Cross-Site Scripting (up to 2.7.3). CVE-2024-43231, https://www.wordfence.com/threat-intel/vulnerabilities/id/4dcb4afc-14e1-43ce-87c4-8f24f1a0d682?source=api-prod
- 2024-08-07 MEDIUM: Missing Authorization (up to 2.7.3). CVE-2024-43142, https://www.wordfence.com/threat-intel/vulnerabilities/id/c82e24a3-8000-4aa5-953e-11415b94909b?source=api-prod
- 2024-08-01 MEDIUM: Cross-Site Request Forgery (up to 2.7.2). CVE-2024-39645, https://www.wordfence.com/threat-intel/vulnerabilities/id/2e617d6f-c1cb-4cac-88e2-3142c1ea9fab?source=api-prod
- 2024-07-10 MEDIUM: Authenticated (Tutor Instructor+) Stored Cross-Site Scripting (up to 2.7.2). CVE-2024-37947, https://www.wordfence.com/threat-intel/vulnerabilities/id/68394503-d989-40d8-b033-24c011294158?source=api-prod
- 2024-07-09 HIGH: SQL Injection (up to 2.7.1). CVE-2024-37256, https://patchstack.com/database/vulnerability/tutor/wordpress-tutor-lms-plugin-2-7-1-sql-injection-vulnerability?_s_id=cve
- 2024-06-27 LOW: Authenticated (Admin+) Path Traversal (up to 2.7.1). CVE-2024-37266, https://www.wordfence.com/threat-intel/vulnerabilities/id/c0c293db-5526-4600-838a-6e88586926c4?source=api-prod
- 2024-06-06 MEDIUM: Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Quiz Attempt Deletion (up to 2.7.1). CVE-2024-5438, https://www.wordfence.com/threat-intel/vulnerabilities/id/00ec14d4-d97b-40b1-b61b-05e911f49bb0?source=api-prod
- 2024-06-06 HIGH: Tutor LMS – eLearning and online course solution <= 2.7.1 -Authenticated (Administrator+) SQL Injection (up to 2.7.1). CVE-2024-4902, https://www.wordfence.com/threat-intel/vulnerabilities/id/f00e8169-3b8f-44a0-9af2-e81777a913f8?source=api-prod
- 2024-05-15 MEDIUM: Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Course Deletion (up to 2.7.0). CVE-2024-4279, https://www.wordfence.com/threat-intel/vulnerabilities/id/45d04643-e43a-4732-91bf-e4af7b622e33?source=api-prod
- 2024-05-15 HIGH: Authenticated (Instructor+) SQL Injection (up to 2.7.0). CVE-2024-4318, https://www.wordfence.com/threat-intel/vulnerabilities/id/9bbb3c65-f02c-4d6d-bd4e-b3232af5e21b?source=api-prod
- 2024-05-15 CRITICAL: Missing Authorization (up to 2.7.0). CVE-2024-4223, https://www.wordfence.com/threat-intel/vulnerabilities/id/ce4c4395-6d1a-4d5f-885f-383e5c44c0f8?source=api-prod
- 2024-04-26 MEDIUM: Missing Authorization to Unauthenticated Limited Options Update (up to 2.6.2). CVE-2024-3553, https://www.wordfence.com/threat-intel/vulnerabilities/id/f8d4029e-07b0-4ceb-ae6e-11a3f7416ebc?source=api-prod
- 2024-04-24 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via 'tutor_instructor_list' Shortcode (up to 2.6.2). CVE-2024-3994, https://www.wordfence.com/threat-intel/vulnerabilities/id/324fc401-04ca-4707-8727-b8c3a66f7fd6?source=api-prod
- 2024-03-12 MEDIUM: Cross-Site Request Forgery to Plugin Deactivation and Data Erase (up to 2.6.1). CVE-2024-1503, https://www.wordfence.com/threat-intel/vulnerabilities/id/050647a8-6743-46e4-b31c-0b5bd4a1007f?source=api-prod
- 2024-03-12 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion (up to 2.6.1). CVE-2024-1502, https://www.wordfence.com/threat-intel/vulnerabilities/id/834c4ca9-7173-4c84-8287-9916ec72935d?source=api-prod
- 2024-03-11 HIGH: Authenticated (Subscriber+) SQL Injection (up to 2.6.1). CVE-2024-1751, https://www.wordfence.com/threat-intel/vulnerabilities/id/f9cee379-79f8-4a60-b1bb-ccab1e954512?source=api-prod
- 2024-02-20 MEDIUM: Authenticated(Student+) HTML Injection via Q&A (up to 2.6.0). CVE-2024-1128, https://www.wordfence.com/threat-intel/vulnerabilities/id/22420c2d-788c-4577-ae54-7b48f6063f5d?source=api-prod
- 2024-02-20 MEDIUM: Missing Authorization (up to 2.6.0). CVE-2024-1133, https://www.wordfence.com/threat-intel/vulnerabilities/id/e8a7c04a-1fa0-434d-8161-7a32cefb44c4?source=api-prod
- 2023-12-05 MEDIUM: Authenticated (Administrator+) Stored Cross-Site Scripting (up to 2.2.4). CVE-2023-49829, https://www.wordfence.com/threat-intel/vulnerabilities/id/e2b2a90f-7a0a-4150-8a24-14b2ed11663e?source=api-prod
- 2023-09-25 MEDIUM: Authenticated (Subscriber+) Stored Cross-Site Scripting (up to 2.2.4). CVE-2023-4805, https://www.wordfence.com/threat-intel/vulnerabilities/id/0a8b5554-b4d9-48f2-ad16-cf96aabcbb6f?source=api-prod
- 2023-06-12 HIGH: Missing Authorization via REST API (up to 2.2.0). CVE-2023-3133, https://www.wordfence.com/threat-intel/vulnerabilities/id/1d6c9765-6936-4b22-835e-e899f62c14c9?source=api-prod
- 2023-05-30 HIGH: Authenticated (Student+) SQL Injection (up to 2.2.0). CVE-2023-25800, https://www.wordfence.com/threat-intel/vulnerabilities/id/2a64b1ff-0d3f-42fa-bab2-4f31bb8f0476?source=api-prod
- 2023-05-30 HIGH: Authenticated (Tutor Instructor+) SQL Injection (up to 2.1.10). CVE-2023-25990, https://www.wordfence.com/threat-intel/vulnerabilities/id/7d623512-ee99-4a73-a752-ecbb6ad96b63?source=api-prod
- 2023-05-30 CRITICAL: Unauthenticated SQL Injection (up to 2.1.10). CVE-2023-25700, https://www.wordfence.com/threat-intel/vulnerabilities/id/9dfee325-9001-4483-b3eb-846da0314529?source=api-prod
- 2023-05-24 MEDIUM: Missing Authorization via multiple AJAX actions (up to 2.1.8). CVE-2023-25799, https://www.wordfence.com/threat-intel/vulnerabilities/id/bf16617d-cec2-4943-bd20-7ade31878714?source=api-prod
- 2023-01-12 MEDIUM: Reflected Cross-Site Scripting (up to 2.0.9). CVE-2023-0236, https://www.wordfence.com/threat-intel/vulnerabilities/id/ed579468-c998-4bec-b3a5-01d0ff206d35?source=api-prod
- 2022-09-26 MEDIUM: Authenticated (Administrator+) Stored Cross-Site Scripting (up to 2.0.9). CVE-2022-2563, https://www.wordfence.com/threat-intel/vulnerabilities/id/5aff79ef-6c96-4386-abf1-b4e6931ef0d2?source=api-prod
- 2022-08-22 MEDIUM: Reflected Cross-Site Scripting (2.0.0 to 2.0.8). WF-bcaf9b92-5e59-47c5-a04e-3ef5c53a2640, https://www.wordfence.com/threat-intel/vulnerabilities/id/bcaf9b92-5e59-47c5-a04e-3ef5c53a2640?source=api-prod
- 2021-12-27 HIGH: Stored Cross-Site Scripting (up to 1.9.11). WF-66130071-668e-4692-afd3-5fcc9039f10f, https://www.wordfence.com/threat-intel/vulnerabilities/id/66130071-668e-4692-afd3-5fcc9039f10f?source=api-prod
- 2021-12-27 MEDIUM: Reflected Cross-Site Scripting (up to 1.9.11). CVE-2021-25017, https://www.wordfence.com/threat-intel/vulnerabilities/id/ad7eee97-332a-4f3c-bba1-d108a769599d?source=api-prod
- 2021-10-19 MEDIUM: Reflected Cross-Site Scripting (up to 1.9.10). CVE-2021-24873, https://www.wordfence.com/threat-intel/vulnerabilities/id/76d57372-9fb5-4166-bfa9-835e3ff7b755?source=api-prod
- 2021-09-20 MEDIUM: Admin+ Stored Cross-Site Scripting (before 1.9.9). CVE-2021-24740, https://www.wordfence.com/threat-intel/vulnerabilities/id/6db9c59e-16bc-4e61-9040-7000b212675f?source=api-prod
- 2021-08-09 MEDIUM: Cross-Site Scripting (up to 1.9.5). WF-a0b14d91-f8f9-41df-b2eb-12792fb3a197, https://www.wordfence.com/threat-intel/vulnerabilities/id/a0b14d91-f8f9-41df-b2eb-12792fb3a197?source=api-prod
- 2021-06-28 MEDIUM: Authenticated Stored Cross-Site Scripting (up to 1.9.1). CVE-2021-24455, https://www.wordfence.com/threat-intel/vulnerabilities/id/65526517-aec5-454b-94c0-973359d840e1?source=api-prod
- 2021-04-05 MEDIUM: Authenticated Local File Inclusion (up to 1.8.7). CVE-2021-24242, https://www.wordfence.com/threat-intel/vulnerabilities/id/76c0d4f8-230d-452a-b39d-cbcb0af0fd72?source=api-prod
- 2021-03-15 HIGH: Unprotected AJAX including Privilege Escalation (before 1.7.7). CVE-2021-24184, https://www.wordfence.com/threat-intel/vulnerabilities/id/64bae119-12c3-4b3e-88a7-2eb5a7b1b537?source=api-prod
- 2021-03-15 MEDIUM: SQL Injection via tutor_quiz_builder_get_question_form (up to 1.8.2). CVE-2021-24183, https://www.wordfence.com/threat-intel/vulnerabilities/id/79f9632e-cfaf-48bd-aeed-919fc729f2b4?source=api-prod
- 2021-03-15 MEDIUM: SQL Injection (before 1.7.7). CVE-2021-24185, https://www.wordfence.com/threat-intel/vulnerabilities/id/a6072f47-91b3-4c5d-b16e-61bcd7760604?source=api-prod
- 2021-03-15 MEDIUM: SQL Injection (before 1.7.7). CVE-2021-24181, https://www.wordfence.com/threat-intel/vulnerabilities/id/c1b81a26-c12c-4b57-9ef1-c53e0b87ad9a?source=api-prod
- 2021-03-15 HIGH: SQL Injection via tutor_quiz_builder_get_answers_by_question (up to 1.8.2). CVE-2021-24182, https://www.wordfence.com/threat-intel/vulnerabilities/id/d6489214-2155-47f4-83ef-0119b3c26e43?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=tutor · HTML: https://todaywp.com/plugins/tutor