Junglewise Threat Intelligence

CVE-2026-13443: Themeum Tutor LMS stored XSS in Lesson Attachment Title

CVE-2026-13443 · Severity: medium · CVSS 6.4 · Published 2026-07-01

Technologies: Themeum Tutor LMS. Vendors: Themeum.

Executive brief

Tutor LMS, a popular WordPress plugin used for creating and managing online courses, contains a security flaw in how it handles lesson attachments. An attacker with instructor or author-level access can upload malicious scripts that execute in the browsers of other users, such as students or administrators, when they view the affected course pages. This could lead to unauthorized actions being performed on behalf of other users or the theft of sensitive session information.

Technical details

Tutor LMS is vulnerable to Stored Cross-Site Scripting (XSS) due to a failure to properly sanitize and escape the 'Lesson Attachment Title' field. The vulnerability is located within the attachment handling logic, specifically affecting components like 'classes/Utils.php' and 'templates/global/attachments.php'. An authenticated attacker with at least 'Author' level privileges can submit a malicious payload via the attachment title. Because the plugin fails to neutralize this input before storing it and subsequently rendering it on the page, the script executes in the context of any user (including administrators) who views the lesson. This is tracked as CWE-79. A patch was introduced in version 3.9.14 (changeset 3590029).

Affected products

  • Themeum Tutor LMS – eLearning and online course solution up to, and including, 3.9.13

Timeline

  • 2026-07-01: disclosed
  • 2026-07-01: advisory

References

Related threats