Live › vulnerability › CVE-2026-88963
Go to dashboardThe Tutor LMS WordPress plugin up to and including 4.0.8 fails to validate the redirect_url parameter in its Topbar back button handler. An attacker can lure a user to a crafted link and run arbitrary JavaScript in the victim's browser.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Tutor LMS plugin at version 4.0.8 or earlier are exposed when a logged-in or visiting user opens a page carrying the malicious redirect_url payload. Sites without Tutor LMS installed, or running a newer release, can skip it.
No product ranges from the sources yet.
wp plugin get tutor --field=version4.0.8; the patched version is unknown from the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via the 'redirect_url' parameter in versions up to, and including, 4.0.8 This is due to insufficient input validation in the Topbar component's back button handler. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in the victim's browser whenever the victim accesses a page that includes the malicious payload.
This page as .md · .json · in your agent: get_signal("CVE-2026-88963")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.