PatchTheCVEtutor lms vulnerabilities and fixes
Recent CVEs affecting tutor lms, with upgrade or downgrade steps. 16 tracked.
Also searched as: tutorlms.
tutor lms has 16 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 16. Most recent: 2025-10-25. Highest priority: CVE-2024-10400 (score 56/100).
- CVE-2025-11564 MEDIUM 5.3 UPGRADE The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modifi
- CVE-2025-6680 MEDIUM 4.3 UPGRADE The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Sensitive Informati
- CVE-2024-5784 HIGH 7.1 UPGRADE The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized administrative actions execution due to
- CVE-2024-5438 MEDIUM 4.3 UPGRADE The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Obj
- CVE-2024-4902 HIGH 7.2 UPGRADE The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Inje
- CVE-2024-43282 HIGH 7.6 UPGRADE Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum
- CVE-2024-43231 MEDIUM 6.5 UPGRADE Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in T
- CVE-2024-43142 MEDIUM 4.3 UPGRADE Missing Authorization vulnerability in Themeum Tutor LMS allows Exploiting Incorrectly Configured Access Contr
- CVE-2024-39645 MEDIUM 5.4 UPGRADE Cross-Site Request Forgery (CSRF) vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a th
- CVE-2024-37947 MEDIUM 5.9 UPGRADE Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in T
- CVE-2024-37266 MEDIUM 4.9 UPGRADE Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Themeum Tutor
- CVE-2024-37256 HIGH 7.6 UPGRADE Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum
- CVE-2024-10400 HIGH 7.5 UPGRADE The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via the ‘rating_filter’ parameter in all ver
- CVE-2024-10393 MEDIUM 5.3 UPGRADE The Tutor LMS plugin for WordPress is vulnerable to bypass to user registration in versions up to, and includi
- CVE-2023-2919 MEDIUM 4.3 UPGRADE The Tutor LMS plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and includin
- CVE-2023-25799 HIGH 8.3 UPGRADE Missing Authorization vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a through 2.1.8.
FAQ
How do I fix tutor lms vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is tutor lms being exploited right now?
None of the tracked tutor lms CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which tutor lms CVE should I patch first?
CVE-2024-10400 currently ranks highest (56/100): The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via the ‘rating_filter’ parameter in all ver.