CVE-2026-93681: Tutor LMS <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name Parameter
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via displayname Parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that a Legal Consent record exists for the attacker's user account, causing the View Logs button to appear in the wp-admin/users.php Consent Logs column.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
An attacker needs an authenticated WordPress account with at least Subscriber-level access. No user interaction is required from the attacker after they submit the malicious display name.
What condition is required for the injected script to be exposed?
A Legal Consent record must exist for the attacker's account. This causes a View Logs button to appear in the Consent Logs column on wp-admin/users.php, where the injected content can execute when a user accesses the affected page.
Who is at risk from a successful exploit?
Users who access the affected injected page in the WordPress administration area may execute the stored script in their browser. The vulnerability has scope changed and can affect confidentiality and integrity, but not availability.
Which versions are affected?
All Themeum Tutor LMS versions up to and including 4.1.0 are affected.