TL
Product
Tutor LMS
60
CVEs
0
On KEV
9.8
Max CVSS
3
New 30D
Severity mix
Critical 2High 19Medium 36Low 3
Watch
Add Tutor LMS to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-4223 | 9.8 | May 16 | Tutor LMS <= 2.7.0 - Missing Authorization Affected: before 2.7.1 |
| CVE-2023-25700 | 9.8 | Nov 3 | WordPress Tutor LMS Plugin <= 2.1.10 is vulnerable to SQL Injection Affected: through 2.1.10 |
| CVE-2024-43142 | 8.8 | Nov 1 | WordPress Tutor LMS plugin <= 2.7.3 - Broken Access Control vulnerability Affected: through 2.7.3 |
| CVE-2024-39645 | 8.8 | Aug 26 | WordPress Tutor LMS plugin <= 2.7.2 - Cross Site Request Forgery (CSRF) vulnerability Affected: through 2.7.2 |
| CVE-2023-25799 | 8.8 | Jun 11 | WordPress Tutor LMS plugin <= 2.1.8 - Multiple Broken Access Control vulnerabilities Affected: through 2.1.8 |
| CVE-2024-4352 | 8.8 | May 16 | Tutor LMS Pro <= 2.7.0 - Missing Authorization to SQL Injection Affected: before 2.7.1 |
| CVE-2024-4351 | 8.8 | May 16 | Tutor LMS Pro <= 2.7.0 - Missing Authorization to Privilege Escalation Affected: before 2.7.1 |
| CVE-2024-1751 | 8.8 | Mar 13 | Tutor LMS – eLearning and online course solution <= 2.6.1 - Authenticated (Subscriber+) SQL Injection Affected: before 2.6.2 |
| CVE-2023-25800 | 8.8 | Nov 3 | WordPress Tutor LMS Plugin <= 2.2.0 is vulnerable to SQL Injection Affected: through 2.2.0 |
| CVE-2023-25990 | 8.8 | Nov 3 | WordPress Tutor LMS Plugin <= 2.1.10 is vulnerable to SQL Injection Affected: through 2.1.10 |
| CVE-2021-24184 | 8.8 | Apr 5 | Several AJAX endpoints in the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 were unprotected, allowing students to modify course information and… Affected: before 1.7.7 |
| CVE-2024-4222 | 8.2 | May 16 | Tutor LMS Pro <= 2.7.0 - Missing Authorization Affected: before 2.7.1 |
| CVE-2025-58993 | 7.6 | Sep 9 | WordPress Tutor LMS Plugin <= 3.7.4 - SQL Injection Vulnerability Affected: through 3.7.4 |
| CVE-2024-10400 | 7.5 | Nov 21 | Tutor LMS <= 2.7.6 - Unauthenticated SQL Injection via rating_filter Affected: through 2.7.6 |
| CVE-2023-3133 | 7.5 | Jul 4 | Tutor LMS < 2.2.1 - Unauthenticated Access to Tutor LMS Lesson Resources via REST API Affected: before 2.2.1 |
| CVE-2024-43282 | 7.2 | Aug 18 | WordPress Tutor LMS plugin <= 2.7.2 - SQL Injection vulnerability Affected: through 2.7.2 |
| CVE-2024-37266 | 7.2 | Jul 9 | WordPress Tutor LMS plugin <= 2.7.1 - Path Traversal vulnerability Affected: through 2.7.1 |
| CVE-2024-37256 | 7.2 | Jul 9 | WordPress Tutor LMS plugin <= 2.7.1 - SQL Injection vulnerability Affected: through 2.7.1 |
| CVE-2024-4902 | 7.2 | Jun 7 | Tutor LMS – eLearning and online course solution <= 2.7.1 -Authenticated (Administrator+) SQL Injection Affected: before 2.7.2 |
| CVE-2026-42702 | 7.1 | Oct 10 | WordPress Tutor LMS plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability Affected: through 4.1.0 |
| CVE-2024-5784 | 7.1 | Aug 30 | Tutor LMS Pro <= 2.7.2 - Missing Authorization to Authenticated (Subscriber+) Insecure Direct Object Reference Affected: before 2.7.3 |
| CVE-2026-111407 | 6.5 | Oct 19 | WordPress Tutor LMS plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerability Affected: through 4.1.2 |
| CVE-2026-57694 | 6.5 | Jul 13 | WordPress Tutor LMS plugin <= 3.9.13 - Insecure Direct Object References (IDOR) vulnerability Affected: through 3.9.13 |
| CVE-2026-40743 | 6.5 | Jun 15 | WordPress Tutor LMS plugin <= 3.9.7 - Broken Access Control vulnerability Affected: through 3.9.7 |
| CVE-2025-32223 | 6.5 | Mar 19 | WordPress Tutor LMS plugin <= 3.9.4 - Insecure Direct Object References (IDOR) vulnerability Affected: through 3.9.4 |
| CVE-2026-23799 | 6.5 | Mar 5 | WordPress Tutor LMS plugin <= 3.9.5 - Broken Access Control vulnerability Affected: through 3.9.5 |
| CVE-2024-4318 | 6.5 | May 16 | Tutor LMS <= 2.7.0 - Authenticated (Instructor+) SQL Injection Affected: before 2.7.1 |
| CVE-2024-4279 | 6.5 | May 16 | Tutor LMS – eLearning and online course solution <= 2.7.0 - Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Course Deletion Affected: before 2.7.1 |
| CVE-2024-3553 | 6.5 | May 2 | Tutor LMS <= 2.6.2 - Missing Authorization to Unauthenticated Limited Options Update Affected: before 2.7.0 |
| CVE-2021-24186 | 6.5 | Apr 5 | The tutor_answering_quiz_question/get_answer_by_id function pair from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION… Affected: before 1.8.3 |
| CVE-2021-24185 | 6.5 | Apr 5 | The tutor_place_rating AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vulnerable to blind and time based SQL injections… Affected: before 1.7.7 |
| CVE-2021-24183 | 6.5 | Apr 5 | The tutor_quiz_builder_get_question_form AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based SQL… Affected: before 1.8.3 |
| CVE-2021-24182 | 6.5 | Apr 5 | The tutor_quiz_builder_get_answers_by_question AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.8.3 was vulnerable to UNION based… Affected: before 1.8.3 |
| CVE-2021-24181 | 6.5 | Apr 5 | The tutor_mark_answer_as_correct AJAX action from the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 was vulnerable to blind and time based SQL… Affected: before 1.7.7 |
| CVE-2020-8615 | 6.5 | Feb 4 | A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an attacker approving themselves as an instructor and performing other malicious actions… Affected: before 1.5.3 |
| CVE-2023-0236 | 6.1 | Feb 6 | Tutor LMS < 2.0.10 - Reflected Cross-Site Scripting Affected: before 2.0.10 |
| CVE-2021-25017 | 6.1 | Jan 24 | The Tutor LMS WordPress plugin before 1.9.12 does not escape the search parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site… Affected: before 1.9.12 |
| CVE-2021-24873 | 6.1 | Nov 23 | The Tutor LMS WordPress plugin before 1.9.11 does not sanitise and escape user input before outputting back in attributes in the Student Registration page, leading to a Reflected… Affected: before 1.9.11 |
| CVE-2026-40740 | 5.4 | Apr 15 | WordPress Tutor LMS plugin <= 3.9.7 - Broken Access Control vulnerability Affected: through 3.9.7 |
| CVE-2024-43231 | 5.4 | Aug 12 | WordPress Tutor LMS plugin <= 2.7.3 - Cross Site Scripting (XSS) vulnerability Affected: through 2.7.3 |
| CVE-2024-3994 | 5.4 | Apr 25 | Tutor LMS – eLearning and online course solution <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tutor_instructor_list' Shortcode Affected: before 2.7.0 |
| CVE-2023-4805 | 5.4 | Oct 16 | Tutor LMS < 2.3.0 - Subscriber+ Stored Cross-Site Scripting Affected: before 2.3.0 |
| CVE-2021-24455 | 5.4 | Aug 2 | The Tutor LMS – eLearning and online course solution WordPress plugin before 1.9.2 did not escape the Summary field of Announcements (when outputting it in an attribute), which… Affected: before 1.9.2 |
| CVE-2026-42698 | 5.3 | Oct 8 | WordPress Tutor LMS plugin <= 4.1.1 - Race Condition vulnerability Affected: through 4.1.1 |
| CVE-2025-11564 | 5.3 | Oct 25 | Tutor LMS – eLearning and online course solution <= 3.8.3 - Missing Authorization to Unauthenticated Payment Status Update Affected: before 3.9.0 |
| CVE-2024-10393 | 5.3 | Nov 21 | Tutor LMS <= 2.7.6 - User Registration Setting Bypass to Unauthorized User Registration Affected: through 2.7.6 |
| CVE-2024-37947 | 4.8 | Jul 20 | WordPress Tutor LMS plugin <= 2.7.2 - Cross Site Scripting (XSS) vulnerability Affected: through 2.7.2 |
| CVE-2023-49829 | 4.8 | Dec 15 | WordPress Tutor LMS Plugin <= 2.2.4 is vulnerable to Cross Site Scripting (XSS) Affected: through 2.2.4 |
| CVE-2022-2563 | 4.8 | Oct 17 | Tutor LMS < 2.0.10 - Admin+ Stored Cross-Site Scripting Affected: before 2.0.10 |
| CVE-2021-24740 | 4.8 | Oct 18 | The Tutor LMS WordPress plugin before 1.9.9 does not escape some of its settings before outputting them in attributes, which could allow high privilege users to perform Cross-Site… Affected: before 1.9.9 |