Filip Kowalski

**Name of the Vulnerable Software and Affected Versions** Tutor LMS versions prior to 4.0.9 **Description** The Tutor LMS plugin for WordPress contains a Reflected Cross-Site Scripting issue caused by insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages by tricking a user into clicking a malicious link. The issue involves the `search` and `back url` parameters. **Recommendations** Update the plugin to a version newer than 4.0.8. Avoid using the `search` and `back url` parameters until the update is applied.