CVE-2026-89081: Tutor LMS <= 4.0.8 - Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters

Q: Who can exploit this issue, and what user interaction is required?

An unauthenticated attacker can craft a malicious request using the affected parameter. The script executes only if the attacker persuades a user to perform an action such as clicking the crafted link.

Q: Which installations are affected?

Tutor LMS WordPress plugin versions up to and including 4.0.8 are affected. The provided information does not identify a fixed version or any configuration prerequisites.

Q: What could a successful exploit allow?

Because the injected script runs in the affected page in the victim's browser, it can impact the confidentiality and integrity of that user's interaction with the site. Availability impact is not indicated.

Published Sep 19, 2026

Updated

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in all versions up to, and including, 4.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Affected Software

1 affected component

Tutor LMS WordPress plugin<=4.0.8

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Tutor LMS – eLearning and online course solution plugin for WordPress to a version that resolves this vulnerability.
Fixed in 4.0.8
Compensating control
Since the issue is Reflected Cross-Site Scripting (reflected XSS), mitigate by preventing untrusted users from inducing victim clicks—for example, use a WAF/filters to block reflected XSS payloads and restrict/monitor access to pages that reflect the 'search'/'back_url' parameters.

Event History

Sep 19, 2026

CVE Published

via MITRE·02:27 AM

Data Sourced

via MITRE·02:27 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue, and what user interaction is required?

An unauthenticated attacker can craft a malicious request using the affected parameter. The script executes only if the attacker persuades a user to perform an action such as clicking the crafted link.

Which installations are affected?

Tutor LMS WordPress plugin versions up to and including 4.0.8 are affected. The provided information does not identify a fixed version or any configuration prerequisites.

What could a successful exploit allow?

Because the injected script runs in the affected page in the victim's browser, it can impact the confidentiality and integrity of that user's interaction with the site. Availability impact is not indicated.

CVE-2026-89081: Tutor LMS <= 4.0.8 - Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue, and what user interaction is required?

Which installations are affected?

What could a successful exploit allow?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue, and what user interaction is required?

Which installations are affected?

What could a successful exploit allow?