CVE Database /
CVE-2021-24455
CVE · Medium
CVE-2021-24455 — Tutor LMS – eLearning and online course solution [tutor] < 1.9.2
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2021-24455
|
Tutor LMS – eLearning and online course solution [tutor] < 1.9.2 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
5.4
|
< 1.9.2
|
1.9.2 |
2021-06-28 |
—
|
CVE-2021-24455
The Tutor LMS plugin before version 1.9.2 failed to properly escape the Summary field when displaying Announcements in HTML attributes, creating a stored cross-site scripting vulnerability. Users with Tutor Instructor privileges could inject malicious scripts through this field, which would execute when administrators or other users viewed the Announcements list. This vulnerability could allow attackers to escalate their privileges by targeting administrative accounts that interact with the affected announcements.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings