cve.bz

CVE-2024-1128

3.5 lowEPSS 0.5%

Low (3.5) in themeum tutor lms. EPSS 0.5% chance of exploitation in the next 30 days.

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 2.6.0. This is due to insufficient sanitization of HTML input in the Q&A functionality. This makes it possible for authenticated attackers, with Student access and above, to inject arbitrary HTML onto a site, though it does not allow Cross-Site Scripting

Severity

CVSS 3.1

3.5 low
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
EPSS
0.5% chance of exploitation in the next 30 days; higher than 42% of CVEs (scores of 2026-10-31)
CWEs
CWE-74, CWE-79
Published
Modified
Record from
the NVD, synced

Affected

References

Check your stackJSON