CVE-2026-93681

Name of the Vulnerable Software and Affected Versions Tutor LMS versions prior to 4.1.1

Description The Tutor LMS plugin for WordPress contains a Stored Cross-Site Scripting issue caused by insufficient input sanitization and output escaping. Authenticated users with subscriber-level access or higher can inject arbitrary web scripts through the display name parameter. These scripts execute when another user accesses the affected page. This exploitation is possible if a Legal Consent record exists for the attacker's account, which triggers the appearance of the View Logs button in the wp-admin/users.php Consent Logs column.

Recommendations Update the plugin to a version newer than 4.1.0. Restrict the ability of subscriber-level users to modify the display name parameter to minimize the risk of exploitation.