CVE Database /
CVE-2024-3994
CVE · Medium
CVE-2024-3994 — Tutor LMS – eLearning and online course solution [tutor] < 2.7.0
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2024-3994
|
Tutor LMS – eLearning and online course solution [tutor] < 2.7.0 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
5.4
|
< 2.7.0
|
2.7.0 |
2024-04-24 |
—
|
CVE-2024-3994
The Tutor LMS plugin for WordPress contains a stored cross-site scripting vulnerability in its tutor_instructor_list shortcode affecting versions up to 2.6.2. Authenticated users with contributor access or higher can inject malicious scripts through unsanitized shortcode attributes because the plugin fails to properly validate input and escape output. These injected scripts will execute for any visitor viewing pages containing the compromised shortcode.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings