CVE Tools
Track your stack

Tutor Lms – Elearning and Online Course Solution

47 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Tutor Lms – Elearning and Online Course Solution, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.

Tutor Lms – Elearning and Online Course Solution CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Tutor Lms – Elearning and Online Course Solution CVEs per month
MonthCVEs
2024-112
2024-120
2025-010
2025-020
2025-030
2025-040
2025-050
2025-060
2025-070
2025-080
2025-090
2025-102
2025-110
2025-120
2026-015
2026-023
2026-030
2026-045
2026-051
2026-061
2026-073
2026-081
2026-095
2026-104

Severity

How the 47 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical12%
  • High817%
  • Medium3779%
  • Low12%

Latest CVEs

The 15 most recently published vulnerabilities affecting Tutor Lms – Elearning and Online Course Solution.

  1. CVE-2026-92715Tutor LMS <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover via 'ID' Parameter4.3
  2. CVE-2026-93681Tutor LMS <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name Parameter6.4
  3. CVE-2026-88963Tutor LMS <= 4.0.8 - Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting via 'redirect_url' Parameter6.1
  4. CVE-2026-100193Tutor LMS <= 4.1.0 - Reflected Cross-Site Scripting via 'tab' Parameter4.7
  5. CVE-2026-18439Tutor LMS <= 4.0.7 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via 'payload' Parameter4.3
  6. CVE-2026-89081Tutor LMS <= 4.0.8 - Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters6.1
  7. CVE-2026-88944Tutor LMS <= 4.0.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id' Parameter4.3
  8. CVE-2026-89333Tutor LMS <= 4.0.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameter6.5
  9. CVE-2026-78175Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution8.8
  10. CVE-2026-16759Tutor LMS <= 4.0.5 - Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters6.5
  11. CVE-2026-15444Tutor LMS <= 4.0.1 - Authenticated (Administrator+) SQL Injection via 'coupon_code' Parameter4.9
  12. CVE-2026-15022Tutor LMS <= 4.0.0 - Authenticated (Subscriber+) SQL Injection via Stored Quiz Answer Array6.5
  13. CVE-2026-13443Tutor LMS <= 3.9.13 - Authenticated (Author+) Stored Cross-Site Scripting via Lesson Attachment Title6.4
  14. CVE-2026-10736Tutor LMS <= 3.9.11 - Authenticated (Administrator+) SQL Injection via 'data' Parameter4.9
  15. CVE-2026-6965Tutor LMS <= 3.9.9 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Post Deletion via 'course' GET Parameter5.3

Product grouping is registry-driven, with AI assist and human review. How it works