Not rated
CVE-2021-24455 The Tutor LMS – eLearning and online course solution WordPress plugin before 1.9.2 did not escape the Summary field of…
Description
The Tutor LMS – eLearning and online course solution WordPress plugin before 1.9.2 did not escape the Summary field of Announcements (when outputting it in an attribute), which can be created by users as low as Tutor Instructor. This lead to a Stored Cross-Site Scripting issue, which is triggered when viewing the Announcements list, and could result in privilege escalation when viewed by an admin.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Tutor LMS – eLearning and online course solution 1.9 | earliest → < 1.9.2 | 1.9.2 |
References
- wpscan.com wpscan.com
Timeline
- Published
- Last modified
Other CVEs of Tutor LMS – eLearning and online course solution
The 11 CVEs of Tutor LMS – eLearning and online course solution →
CVE-2022-2563
The Tutor LMS WordPress plugin before 2.0.10 does not escape some course parameters, which could allow high privilege…
4.8
Medium
CVE-2021-25017
The Tutor LMS WordPress plugin before 1.9.12 does not escape the search parameter before outputting it back in an…
Not rated
CVE-2021-24873
The Tutor LMS WordPress plugin before 1.9.11 does not sanitise and escape user input before outputting back in…
Not rated
CVE-2021-24740
The Tutor LMS WordPress plugin before 1.9.9 does not escape some of its settings before outputting them in attributes,…
Not rated