CVE-2026-42702: WordPress Tutor LMS plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability

Q: Does exploitation require an authenticated WordPress account?

No. The vulnerability is described as unauthenticated, so an attacker does not need a WordPress account or prior privileges. Exploitation does require user interaction.

Q: Which Tutor LMS versions are affected?

Tutor LMS versions up to and including 4.1.0 are identified as affected.

Q: What could a successful attack impact?

The supplied severity vector indicates low potential impact to confidentiality, integrity, and availability, with scope changed. As an XSS issue, the attack relies on malicious script execution in a user’s browser.

Published Oct 10, 2026

Updated

Unauthenticated Cross Site Scripting (XSS) in Tutor LMS <= 4.1.0 versions.

Affected Software

1 affected component

Themeum Tutor LMS<=4.1.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Tutor LMS plugin to a version that resolves this vulnerability.
Fixed in 4.1.1

Event History

Oct 10, 2026

CVE Published

via MITRE·07:35 PM

Data Sourced

via MITRE·07:35 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·08:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Does exploitation require an authenticated WordPress account?

No. The vulnerability is described as unauthenticated, so an attacker does not need a WordPress account or prior privileges. Exploitation does require user interaction.

Which Tutor LMS versions are affected?

Tutor LMS versions up to and including 4.1.0 are identified as affected.

What could a successful attack impact?

The supplied severity vector indicates low potential impact to confidentiality, integrity, and availability, with scope changed. As an XSS issue, the attack relies on malicious script execution in a user’s browser.

CVE-2026-42702: WordPress Tutor LMS plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Does exploitation require an authenticated WordPress account?

Which Tutor LMS versions are affected?

What could a successful attack impact?

Company

Resources

Contact

Frequently Asked Questions

Does exploitation require an authenticated WordPress account?

Which Tutor LMS versions are affected?

What could a successful attack impact?