CVE-2024-3994

Name of the Vulnerable Software and Affected Versions Tutor LMS versions up to, and including, 2.6.2

Description The issue is related to Stored Cross-Site Scripting via the plugin's 'tutor instructor list' shortcode due to insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Recommendations For versions up to, and including, 2.6.2, consider disabling the tutor instructor list shortcode until a patch is available to prevent exploitation. Restrict access to pages that utilize this shortcode to minimize the risk of arbitrary web script execution. Update to a version that includes proper input sanitization and output escaping for the tutor instructor list shortcode to fully resolve the issue.