Live › vulnerability › CVE-2026-111407
Go to dashboardTutor LMS, a WordPress learning management plugin by Themeum, fails to sanitize some input, so a stored script can be saved and later run in another user's browser. An attacker who can submit content that gets stored can run JavaScript in the session of anyone who views it, such as an admin.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Tutor LMS plugin at version 4.1.2 or older are in the reported range. The sources do not say which input fields or roles are needed to store the payload, so exposure depends on who can submit content on the site. Sites without Tutor LMS installed can skip it.
No product ranges from the sources yet.
wp plugin get tutor --field=version4.1.2; versions at or below it are in the reported range4.1.2, per the plugin's changelog on WordPress.orgEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Stored XSS.This issue affects Tutor LMS: from n/a through 4.1.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-111407")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.