CVE-2026-13443: Stored XSS in Tutor LMS WordPress Plugin (Lesson Attachment Title)

Technical summary

CVE-2026-13443 is a Stored Cross-Site Scripting (XSS) vulnerability in Tutor LMS stemming from inadequate input sanitization and output escaping of the Lesson Attachment Title field. An authenticated user with author-level or administrative privileges can inject arbitrary JavaScript that persists in the database. The vulnerability has a CVSS v3.1 score of 6.4 (Medium severity) with a vector indicating network-accessible exploitation, low attack complexity, and requirement for low-privilege authentication. The injected payload executes in the context of any user who subsequently accesses the affected lesson page, potentially allowing session hijacking, credential theft, or malware distribution within the WordPress environment.

Business impact

Organizations relying on Tutor LMS for course delivery face reputational and operational risk if attackers compromise course content or student sessions. In educational and corporate training contexts, stored XSS can enable data exfiltration of student records, test answers, or completion certificates. The requirement for author-level access means the threat landscape includes compromised instructor accounts, disgruntled staff, or supply-chain compromise of plugin integrations. Depending on the sensitivity of course material and student data, incidents could trigger data protection compliance obligations (FERPA, GDPR, etc.) and erode institutional trust.

Affected systems

The vulnerability affects all versions of the Tutor LMS – eLearning and online course solution plugin for WordPress up to and including version 3.9.13. Any WordPress installation running this plugin with multiuser authorship capability (authors or admins creating lessons with attachments) is potentially vulnerable. The threat is highest in public or semi-public WordPress networks where author accounts are distributed among instructors, third-party consultants, or content partners.

Exploitability

Exploitation requires authentication—specifically author-level access or higher within WordPress. Attack complexity is low: an attacker simply crafts a lesson attachment with a malicious title containing JavaScript and waits for other users to access the lesson. No user interaction beyond normal course viewing is required for payload execution. The stored nature of the XSS means a single injection can compromise many users over time, making it attractive to motivated attackers with insider access or those who have compromised instructor accounts through phishing or credential stuffing.

Remediation

Update the Tutor LMS plugin to a patched version released after 2026-07-01. Verify the specific version number against the official plugin repository or vendor advisory. Until patching is possible, restrict author-level access to trusted personnel only, audit existing lesson attachments for suspicious titles containing script tags or encoded payloads, and consider temporarily disabling the lesson attachment feature if operationally feasible. Implement Content Security Policy (CSP) headers on your WordPress site to mitigate XSS payload execution.

Patch guidance

Check the official Tutor LMS plugin repository and the plugin developer's security advisories for patch availability. Update through the WordPress admin dashboard (Plugins > Updates) once a patched version is released. Before deploying to production, test the update in a staging environment to ensure compatibility with your course structure and any custom integrations. After patching, review lesson attachment titles from the period before the update to identify and remove any suspicious content.

Detection guidance

Audit lesson attachment titles for presence of HTML/JavaScript patterns such as <script>, onerror=, onclick=, or encoded variations (%3c, &#60;, etc.). Review WordPress administrator and author activity logs for unusual lesson or attachment modifications. Monitor web application firewall (WAF) logs for POST requests to lesson endpoints containing script injection patterns. Query your WordPress database directly: examine the wp_posts and wp_postmeta tables for suspicious serialized data in lesson attachment metadata. Enable WordPress security plugins with XSS detection capabilities to flag existing or new malicious attachments.

Why prioritize this

Although rated MEDIUM in CVSS terms, prioritize remediation based on your WordPress user model: if multiple untrusted authors have access, this is higher risk. The stored nature of the XSS and broad audience reach (all course students) amplify impact. The vulnerability is not currently listed in CISA's KEV catalog, but its presence in a widely-used plugin warrants rapid assessment and patching in any educational or training deployment.

Risk score, explained

The CVSS 6.4 (Medium) score reflects the requirement for authentication (PR:L), lack of availability impact (A:N), but cross-site context (S:C) that can affect many users. If your WordPress instance has many authors or open registration, effective risk is higher than the base score suggests. The exploitability is straightforward and requires no special tools or knowledge—any author can craft a malicious title.

Frequently asked questions