Is CVE-2026-93681 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-93681 being exploited in the wild.

How severe is CVE-2026-93681?

Medium severity, with a CVSS score of 6.4, published 16 October 2026.

Which products and versions are affected?

Themeum Tutor LMS up to and including 4.1.0.

Is there a fix for CVE-2026-93681?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-93681 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-93681?

Check whether you run Themeum Tutor LMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-93681: Tutor LMS stored cross-site scripting via display_name

CVE-2026-93681 · Severity: medium · CVSS 6.4 · Published 2026-10-16

Tutor LMS is a WordPress plugin that enables educational institutions to create and manage online courses. The plugin fails to properly sanitize the display_name parameter, allowing authenticated users with subscriber-level access to inject malicious scripts that execute in administrators' browsers. An attacker could steal credentials, modify course content, or compromise instructor accounts through this vector.

Technologies: Themeum Tutor LMS. Vendors: Themeum.

Quick answers

Is CVE-2026-93681 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-93681 being exploited in the wild.
How severe is CVE-2026-93681?: Medium severity, with a CVSS score of 6.4, published 16 October 2026.
Which products and versions are affected?: Themeum Tutor LMS up to and including 4.1.0.
Is there a fix for CVE-2026-93681?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-93681 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-93681?: Check whether you run Themeum Tutor LMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a stored XSS flaw in the display_name parameter within the plugin's GDPR/Consent logging functionality, affecting versions up to 4.1.0. Exploitation requires an authenticated attacker with subscriber-level access and a Legal Consent record on file; when triggered, injected scripts execute in the context of any user viewing the Consent Logs column in wp-admin/users.php. The plugin insufficiently sanitizes input and fails to escape output, allowing persistence of malicious payloads.

Affected products

Themeum Tutor LMS up to and including 4.1.0

Timeline

2026-10-16: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.