Filip Kowalski

The LatePoint WordPress plugin before 5.7.5 does not validate the client-supplied value that determines how much is charged for a booking against the amounts the service and site actually allow, allowing an unauthenticated visitor to make the amount due resolve to zero and obtain a confirmed appointment and a recorded order without completing any payment.

**Name of the Vulnerable Software and Affected Versions** Tutor LMS versions prior to 4.0.9 **Description** The Tutor LMS plugin for WordPress contains a Reflected Cross-Site Scripting issue caused by insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages by tricking a user into clicking a malicious link. The issue involves the `search` and `back url` parameters. **Recommendations** Update the plugin to a version newer than 4.0.8. Avoid using the `search` and `back url` parameters until the update is applied.