CVE-2026-89081

Name of the Vulnerable Software and Affected Versions Tutor LMS versions prior to 4.0.9

Description The Tutor LMS plugin for WordPress contains a Reflected Cross-Site Scripting issue caused by insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages by tricking a user into clicking a malicious link. The issue involves the search and back url parameters.

Recommendations Update the plugin to a version newer than 4.0.8. Avoid using the search and back url parameters until the update is applied.