Is CVE-2026-13443 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-13443 being exploited in the wild.

How severe is CVE-2026-13443?

Medium severity, with a CVSS score of 6.4, published 1 July 2026.

Which products and versions are affected?

Themeum Tutor LMS up to, and including, 3.9.13.

Is there a fix for CVE-2026-13443?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-13443 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-13443?

Check whether you run Themeum Tutor LMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-13443: Themeum Tutor LMS stored XSS in Lesson Attachment Title

CVE-2026-13443 · Severity: medium · CVSS 6.4 · Published 2026-07-01

Tutor LMS, a popular WordPress plugin used for creating and managing online courses, contains a security flaw in how it handles lesson attachments. An attacker with instructor or author-level access can upload malicious scripts that execute in the browsers of other users, such as students or administrators, when they view the affected course pages. This could lead to unauthorized actions being performed on behalf of other users or the theft of sensitive session information.

Technologies: Themeum Tutor LMS. Vendors: Themeum.

Quick answers

Is CVE-2026-13443 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-13443 being exploited in the wild.
How severe is CVE-2026-13443?: Medium severity, with a CVSS score of 6.4, published 1 July 2026.
Which products and versions are affected?: Themeum Tutor LMS up to, and including, 3.9.13.
Is there a fix for CVE-2026-13443?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-13443 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-13443?: Check whether you run Themeum Tutor LMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Tutor LMS is vulnerable to Stored Cross-Site Scripting (XSS) due to a failure to properly sanitize and escape the 'Lesson Attachment Title' field. The vulnerability is located within the attachment handling logic, specifically affecting components like 'classes/Utils.php' and 'templates/global/attachments.php'. An authenticated attacker with at least 'Author' level privileges can submit a malicious payload via the attachment title. Because the plugin fails to neutralize this input before storing it and subsequently rendering it on the page, the script executes in the context of any user (including administrators) who views the lesson. This is tracked as CWE-79. A patch was introduced in version 3.9.14 (changeset 3590029).

Affected products

Themeum Tutor LMS – eLearning and online course solution up to, and including, 3.9.13

Timeline

2026-07-01: disclosed
2026-07-01: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.