# CVE-2026-88963: Tutor LMS DOM-based XSS in redirect_url parameter

Source: https://junglewise.ai/threats/cve-2026-88963-the-tutor-lms-elearning-and-online-course-solution-plugin-for  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-16. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-88963 · Severity: medium · CVSS 6.1 · Published 2026-10-16

Tutor LMS is a WordPress plugin that provides an online course and learning management platform. The plugin fails to properly validate user input in the redirect_url parameter, allowing unauthenticated attackers to inject malicious scripts that execute in a victim's browser when they visit a crafted page link. This could lead to credential theft, session hijacking, or malware distribution to course participants and instructors.

Technologies: [Tutor LMS](https://junglewise.ai/threats/technologies/tutor-tutor-lms). Vendors: [Tutor](https://junglewise.ai/threats/vendors/tutor).

## Quick answers

**Is CVE-2026-88963 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-88963 being exploited in the wild.

**How severe is CVE-2026-88963?** Medium severity, with a CVSS score of 6.1, published 16 October 2026.

**Which products and versions are affected?** Tutor LMS up to and including 4.0.8.

**Is there a fix for CVE-2026-88963?** Yes: fixed in 4.0.9. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-88963 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-88963?** Check whether you run Tutor LMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.0.9

## Technical details

The vulnerability is a DOM-based Cross-Site Scripting (XSS) flaw in the Topbar component's back button handler that does not properly validate the redirect_url parameter. An unauthenticated attacker can craft a malicious URL with JavaScript payload in the redirect_url parameter, and when a victim clicks the link or visits the page, the script executes in their browser context. The flaw affects versions through 4.0.8, and a fix appears to be available in version 4.0.9.

## Affected products

- Tutor Tutor LMS up to and including 4.0.8

## Timeline

- 2026-10-16: disclosed

## References

- [https://plugins.trac.wordpress.org/changeset/3700174/tutor/trunk/assets/js/tutor-order-details.js](https://plugins.trac.wordpress.org/changeset/3700174/tutor/trunk/assets/js/tutor-order-details.js)
- [https://plugins.trac.wordpress.org/changeset?reponame=&new=3700174%40tutor%2Ftags%2F4.0.9&old=3690454%40tutor%2Ftags%2F4.0.8](https://plugins.trac.wordpress.org/changeset?reponame=&new=3700174%40tutor%2Ftags%2F4.0.9&old=3690454%40tutor%2Ftags%2F4.0.8)

## Related threats

- [Tutor LMS WordPress plugin quiz answer disclosure](https://junglewise.ai/threats/cve-2026-85570-the-tutor-lms-wordpress-plugin-before-4-2-0-does-not-prevent-the)
- [Tutor LMS WordPress plugin arbitrary post reparenting via IDOR](https://junglewise.ai/threats/cve-2026-85571-the-tutor-lms-wordpress-plugin-before-4-1-1-does-not-verify-that)