CVE-2023-4805

The Tutor LMS WordPress plugin before 2.3.0 does not sanitise and escape some of its settings, which could allow users such as subscriber to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Affected products

Tutor Lms

Themeum Tutor Lms

< 2.3.0

Fix

Available

CVSS 3.1

5.4 MEDIUM

EPSS

0.4% (34th percentile)

NVD status

Modified

Published

2023-10-16