{"id":"CVE-2026-111407","kind":"vulnerability","aliases":["CVE-2026-111407"],"related":[],"title":"Tutor LMS WordPress plugin: stored XSS through 4.1.2 lets scripts run","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Stored XSS.This issue affects Tutor LMS: from n/a through 4.1.2.","summary":"Tutor LMS, a WordPress learning management plugin by Themeum, fails to sanitize some input, so a stored script can be saved and later run in another user's browser. An attacker who can submit content that gets stored can run JavaScript in the session of anyone who views it, such as an admin.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","tutor-lms","wordpress"],"not_affected_if":["patched-version","plugin-not-installed"],"how_to_check":"- Check the installed Tutor LMS version in the WordPress admin plugins page or with `wp plugin get tutor --field=version`\n- Compare the result against `4.1.2`; versions at or below it are in the reported range","fix":"- Update Tutor LMS to a version newer than `4.1.2`, per the plugin's changelog on WordPress.org\n- unknown: the sources do not name the fixed version","status":"open","published_at":"2026-10-19T10:16:46+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T03:57:16+00:00","updated_at":"2026-10-25T03:57:16+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:57:16Z","model":"claude-haiku-5-5","output":{"fix":"- Update Tutor LMS to a version newer than `4.1.2`, per the plugin's changelog on WordPress.org\n- unknown: the sources do not name the fixed version","reach":"internet","title":"Tutor LMS WordPress plugin: stored XSS through 4.1.2 lets scripts run","impact":"medium","summary":"Tutor LMS, a WordPress learning management plugin by Themeum, fails to sanitize some input, so a stored script can be saved and later run in another user's browser. An attacker who can submit content that gets stored can run JavaScript in the session of anyone who views it, such as an admin.","category":"package","nicknames":[],"who_cares":["wordpress","tutor-lms","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Stored script runs in other users' browsers, possibly admin sessions","analyst_note":"Find the fixed version and the vulnerable input field from the NVD entry or the Wordfence/Patchstack advisory for Tutor LMS.","how_to_check":"- Check the installed Tutor LMS version in the WordPress admin plugins page or with `wp plugin get tutor --field=version`\n- Compare the result against `4.1.2`; versions at or below it are in the reported range","needs_analyst":true,"not_affected_if":["plugin-not-installed","patched-version"],"who_is_affected":"Sites running the Tutor LMS plugin at version 4.1.2 or older are in the reported range. The sources do not say which input fields or roles are needed to store the payload, so exposure depends on who can submit content on the site. Sites without Tutor LMS installed can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000635,"input_tokens":3311,"output_tokens":608,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111407':14A,17A '-2026':13A,16A '4.1.2':8A,107C 'admin':78B 'affect':101C 'allow':97C 'anoth':51B 'anyon':71B 'attack':56B 'browser':54B 'content':60B 'cross':88C 'cross-sit':87C 'cve':12A,15A 'fail':35B 'generat':86C 'get':62B 'host':21B 'improp':79C 'input':39B,82C 'issu':100C 'javascript':66B 'later':48B 'learn':30B 'let':9A 'lms':2A,24B,27B,95C,103C 'manag':31B 'n/a':105C 'neutral':80C 'packag':18B 'page':85C 'plugin':4A,32B 'run':11A,49B,65B 'sanit':37B 'save':46B 'script':10A,43B,90C 'self':20B 'self-host':19B 'session':69B 'site':89C 'store':5A,42B,63B,98C 'submit':59B 'themeum':34B,93C 'tutor':1A,23B,26B,94C,96C,102C 'tutor-lm':22B 'user':52B 'view':73B 'vulner':91C 'web':84C 'wordpress':3A,25B,29B 'xss':6A 'xss.this':99C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Tutor LMS plugin at version 4.1.2 or older are in the reported range. The sources do not say which input fields or roles are needed to store the payload, so exposure depends on who can submit content on the site. Sites without Tutor LMS installed can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T10:16:46+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111407","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111407","severity":null,"published_at":"2026-10-19T10:16:46+00:00","modified_at":"2026-10-19T15:16:45+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}