---
id: "CVE-2026-111407"
kind: "vulnerability"
aliases: ["CVE-2026-111407"]
title: "Tutor LMS WordPress plugin: stored XSS through 4.1.2 lets scripts run"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "tutor-lms", "wordpress"]
not_affected_if: ["patched-version", "plugin-not-installed"]
published_at: "2026-10-19T10:16:46+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T03:57:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111407", "first_seen_at": "2026-10-23T21:57:17+00:00"}]
---

# Tutor LMS WordPress plugin: stored XSS through 4.1.2 lets scripts run

Tutor LMS, a WordPress learning management plugin by Themeum, fails to sanitize some input, so a stored script can be saved and later run in another user's browser. An attacker who can submit content that gets stored can run JavaScript in the session of anyone who views it, such as an admin.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Tutor LMS version in the WordPress admin plugins page or with `wp plugin get tutor --field=version`
- Compare the result against `4.1.2`; versions at or below it are in the reported range

## Fix

- Update Tutor LMS to a version newer than `4.1.2`, per the plugin's changelog on WordPress.org
- unknown: the sources do not name the fixed version

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111407

## From the sources

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Stored XSS.This issue affects Tutor LMS: from n/a through 4.1.2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_