Themeum Tutor LMS – eLearning and online course solution

• CVE-2026-93779 Medium 6.5 Tutor LMS <= 4.1.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via REST API Endpoints –
• CVE-2026-92715 Medium 4.3 Tutor LMS <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover via 'ID' Parameter 0.2%
• CVE-2026-93681 Medium 6.4 Tutor LMS <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name Parameter 0.2%
• CVE-2026-88963 Medium 6.1 Tutor LMS <= 4.0.8 - Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting via 'redirect_url' Parameter 0.2%
• CVE-2026-100193 Medium 4.7 Tutor LMS <= 4.1.0 - Reflected Cross-Site Scripting via 'tab' Parameter 0.2%
• CVE-2026-18439 Medium 4.3 Tutor LMS <= 4.0.7 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via 'payload' Parameter 0.4%
• CVE-2026-89081 Medium 6.1 Tutor LMS <= 4.0.8 - Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters 0.4%
• CVE-2026-88944 Medium 4.3 Tutor LMS <= 4.0.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id' Parameter 0.5%
• CVE-2026-89333 Medium 6.5 Tutor LMS <= 4.0.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameter 0.5%
• CVE-2026-78175 High 8.8 Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution 1.1%
• CVE-2026-16759 Medium 6.5 Tutor LMS <= 4.0.5 - Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters 0.7%
• CVE-2026-15444 Medium 4.9 Tutor LMS <= 4.0.1 - Authenticated (Administrator+) SQL Injection via 'coupon_code' Parameter 0.5%
• CVE-2026-15022 Medium 6.5 Tutor LMS <= 4.0.0 - Authenticated (Subscriber+) SQL Injection via Stored Quiz Answer Array 0.6%
• CVE-2026-13443 Medium 6.4 Tutor LMS <= 3.9.13 - Authenticated (Author+) Stored Cross-Site Scripting via Lesson Attachment Title 0.4%
• CVE-2026-10736 Medium 4.9 Tutor LMS <= 3.9.11 - Authenticated (Administrator+) SQL Injection via 'data' Parameter 0.5%
• CVE-2026-6965 Medium 5.3 Tutor LMS <= 3.9.9 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Post Deletion via 'course' GET Parameter 0.3%
• CVE-2026-5502 Medium 5.3 Tutor LMS <= 3.9.8 - Authenticated (Subscriber+) Arbitrary Course Content Manipulation via tutor_update_course_content_order 0.5%
• CVE-2026-6080 Medium 6.5 Tutor LMS <= 3.9.8 - Authenticated (Admin+) SQL Injection via 'date' Parameter 0.5%
• CVE-2026-3371 Medium 4.3 Tutor LMS <= 3.9.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Course Content Modification 0.4%
• CVE-2026-3358 Medium 5.4 Tutor LMS <= 3.9.7 - Missing Authorization to Authenticated (Subscriber+) Unauthorized Private Course Enrollment 0.4%
• CVE-2026-3360 High 7.5 Tutor LMS <= 3.9.7 - Missing Authorization to Unauthenticated Arbitrary Billing Profile Overwrite via 'order_id' Parameter 0.6%
• CVE-2025-13673 High 7.5 Tutor LMS <= 3.9.6 - Unauthenticated SQL Injection via coupon_code 0.5%
• CVE-2026-1371 Medium 5.3 Tutor LMS <= 3.9.5 - Authenticated (Subscriber+) Information Disclosure in Coupon Details via 'tutor_coupon_details' AJAX Action 0.3%
• CVE-2026-1375 High 8.1 Tutor LMS <= 3.9.5 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Course Modification and Deletion 0.4%
• CVE-2026-0548 Medium 5.4 Tutor LMS – eLearning and online course solution <= 3.9.4 - Missing Authorization to Authenticated (Subscriber+) Limited Attachment Deletion 0.3%
• CVE-2025-13935 Medium 4.3 Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Course Completion 0.2%
• CVE-2025-13934 Medium 4.3 Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Course Enrollment Bypass 0.2%
• CVE-2025-13628 Medium 4.3 Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Coupon Modification 0.2%
• CVE-2025-13679 Medium 6.5 Tutor LMS <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via tutor_order_details 0.2%
• CVE-2025-11564 Medium 5.3 Tutor LMS – eLearning and online course solution <= 3.8.3 - Missing Authorization to Unauthenticated Payment Status Update 0.3%
• CVE-2025-6680 Medium 4.3 Tutor LMS <= 3.8.3 - Missing Authorization to Sensitive Information Exposure 0.2%
• CVE-2024-10400 High 7.5 Tutor LMS <= 2.7.6 - Unauthenticated SQL Injection via rating_filter 83.1%
• CVE-2024-10393 Medium 5.3 Tutor LMS <= 2.7.6 - User Registration Setting Bypass to Unauthorized User Registration 0.6%
• CVE-2023-2919 Medium 4.3 Tutor LMS <= 2.7.4 - Cross-Site Request Forgery via 'addon_enable_disable' 0.2%
• CVE-2024-5438 Medium 4.3 Tutor LMS – eLearning and online course solution <= 2.7.1 - Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Quiz Attempt Deletion 0.3%
• CVE-2024-4902 High 7.2 Tutor LMS – eLearning and online course solution <= 2.7.1 -Authenticated (Administrator+) SQL Injection 0.5%
• CVE-2024-4223 Critical 9.8 Tutor LMS <= 2.7.0 - Missing Authorization 0.5%
• CVE-2024-4318 High 8.8 Tutor LMS <= 2.7.0 - Authenticated (Instructor+) SQL Injection 0.5%
• CVE-2024-4279 Medium 6.5 Tutor LMS – eLearning and online course solution <= 2.7.0 - Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Course Deletion 0.4%
• CVE-2024-3553 Medium 6.5 Tutor LMS <= 2.6.2 - Missing Authorization to Unauthenticated Limited Options Update 0.5%
• CVE-2024-3994 Medium 5.4 Tutor LMS – eLearning and online course solution <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tutor_instructor_list' Shortcode 0.4%
• CVE-2024-1751 High 8.8 Tutor LMS – eLearning and online course solution <= 2.6.1 - Authenticated (Subscriber+) SQL Injection 3.1%
• CVE-2024-1502 Medium 5.4 Tutor LMS – eLearning and online course solution <= 2.6.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion 0.4%
• CVE-2024-1503 Medium 4.3 Tutor LMS – eLearning and online course solution <= 2.6.1 - Cross-Site Request Forgery to Plugin Deactivation and Data Erase 0.2%
• CVE-2024-1133 Medium 4.3 Tutor LMS <= 2.6.0 - Missing Authorization 0.4%
• CVE-2024-1128 Medium 5.4 Tutor LMS <= 2.6.0 - Authenticated(Student+) HTML Injection via Q&A 0.5%
• CVE-2023-49829 Medium 5.9 WordPress Tutor LMS Plugin <= 2.2.4 is vulnerable to Cross Site Scripting (XSS) 0.4%
• CVE-2021-24242 Unrated Tutor LMS < 1.8.8 - Authenticated Local File Inclusion 0.8%