Tutor LMS <4.0.8 Reflected XSS via search param
CVE-2026-89081 Published on September 19, 2026
Tutor LMS <= 4.0.8 - Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters
The Tutor LMS eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in all versions up to, and including, 4.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Timeline
Vendor Notified
Disclosed 8 days later.
Weakness Type
What is a XSS Vulnerability?
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVE-2026-89081 has been classified to as a XSS vulnerability or weakness.
Products Associated with CVE-2026-89081
Want to know whenever a new CVE is published for Themeum Tutor Lms? stack.watch will email you.
Affected Versions
themeum Tutor LMS – eLearning and online course solution:- Before and including 4.0.8 is affected.