Tutor LMS – eLearning and online course solution vulnerabilities
Plugin slug tutor · 102 known vulnerabilities · latest disclosed 2026-11-06 · WordPress.org page
1 vulnerability has no fixed version yet. If you use this plugin, consider disabling or replacing it until a fix is released.
22 of 102 rated high or critical (CVSS 7 or more).
Known vulnerabilities in Tutor LMS – eLearning and online course solution
| Severity | Affected versions | Fixed in | CVE | Published | Details |
|---|---|---|---|---|---|
| Medium 6.5 | <= 4.1.2 | 4.1.3 | CVE-2026-93779 | 2026-11-06 | Advisory |
| Medium 4.3 | 1.6.4 to 4.1.3 | 4.2.0 | CVE-2026-85570 | 2026-11-02 | Advisory |
| Medium 6.4 | <= 4.1.2 | 4.1.3 | CVE-2026-111407 | 2026-10-17 | Advisory |
| Medium 4.3 | <= 4.1.0 | 4.1.1 | CVE-2026-92715 | 2026-10-16 | Advisory |
| Medium 6.4 | <= 4.1.0 | 4.1.1 | CVE-2026-93681 | 2026-10-15 | Advisory |
| Medium 6.1 | <= 4.0.8 | 4.0.9 | CVE-2026-88963 | 2026-10-15 | Advisory |
| Medium 4.7 | <= 4.1.0 | 4.1.1 | CVE-2026-100193 | 2026-10-13 | Advisory |
| Medium 5.3 | <= 4.1.0 | 4.1.1 | CVE-2026-96537 | 2026-10-13 | Advisory |
| Medium 4.3 | 4.0.5 to 4.1.0 | 4.1.1 | CVE-2026-85571 | 2026-10-08 | Advisory |
| Medium 4.3 | <= 4.1.2 | No fix yet | CVE-2026-42698 | 2026-10-08 | Advisory |
| High 7.2 | <= 4.1.0 | 4.1.1 | CVE-2026-42702 | 2026-10-06 | Advisory |
| Medium 4.3 | <= 4.0.7 | 4.0.8 | CVE-2026-18439 | 2026-09-21 | Advisory |
| Medium 6.1 | <= 4.0.8 | 4.0.9 | CVE-2026-89081 | 2026-09-18 | Advisory |
| Medium 4.3 | <= 4.0.8 | 4.0.9 | CVE-2026-88944 | 2026-09-18 | Advisory |
| Medium 6.5 | <= 4.0.8 | 4.0.9 | CVE-2026-89333 | 2026-09-18 | Advisory |
| Medium 4.3 | <= 4.0.7 | 4.0.8 | CVE-2026-85569 | 2026-09-14 | Advisory |
| Medium 4.3 | <= 4.0.7 | 4.0.8 | CVE-2026-85572 | 2026-09-14 | Advisory |
| High 8.8 | <= 4.0.7 | 4.0.8 | CVE-2026-78175 | 2026-09-11 | Advisory |
| Medium 6.5 | < 4.0.6 | 4.0.6 | CVE-2026-19093 | 2026-08-28 | Advisory |
| Medium 6.5 | <= 4.0.5 | 4.0.6 | CVE-2026-16759 | 2026-08-27 | Advisory |
| Critical 9.8 | <= 4.0.5 | 4.0.6 | CVE-2026-19092 | 2026-08-26 | Advisory |
| High 7.5 | < 4.0.6 | 4.0.6 | CVE-2026-19094 | 2026-08-24 | Advisory |
| Medium 4.3 | <= 4.0.5 | 4.0.6 | CVE-2026-14187 | 2026-08-20 | Advisory |
| Medium 4.3 | < 4.0.0 | 4.0.0 | CVE-2026-14310 | 2026-07-30 | Advisory |
| Medium 4.9 | <= 4.0.1 | 4.0.2 | CVE-2026-15444 | 2026-07-27 | Advisory |
| Medium 6.5 | <= 4.0.0 | 4.0.1 | CVE-2026-15022 | 2026-07-15 | Advisory |
| Medium 4.3 | <= 3.9.13 | 3.9.14 | CVE-2026-57694 | 2026-07-06 | Advisory |
| Medium 4.3 | <= 3.9.13 | 3.9.14 | CVE-2026-14306 | 2026-07-02 | Advisory |
| Medium 6.4 | <= 3.9.13 | 3.9.14 | CVE-2026-13443 | 2026-06-30 | Advisory |
| Medium 4.3 | <= 3.9.12 | 3.9.13 | CVE-2026-12275 | 2026-06-22 | Advisory |
| Medium 4.3 | <= 3.9.12 | 3.9.13 | CVE-2026-12273 | 2026-06-22 | Advisory |
| Medium 4.3 | <= 3.9.12 | 3.9.13 | CVE-2026-12271 | 2026-06-22 | Advisory |
| Medium 4.9 | <= 3.9.11 | 3.9.12 | CVE-2026-10736 | 2026-06-17 | Advisory |
| Medium 5.3 | <= 3.9.9 | 3.9.10 | CVE-2026-6965 | 2026-05-12 | Advisory |
| Medium 5.3 | <= 3.9.7 | 3.9.8 | CVE-2026-40743 | 2026-04-20 | Advisory |
| Medium 6.5 | <= 3.9.8 | 3.9.9 | CVE-2026-6080 | 2026-04-16 | Advisory |
| Medium 5.3 | <= 3.9.8 | 3.9.9 | CVE-2026-5502 | 2026-04-16 | Advisory |
| Medium 4.3 | <= 3.9.7 | 3.9.8 | CVE-2026-3371 | 2026-04-10 | Advisory |
| Medium 5.4 | <= 3.9.7 | 3.9.8 | CVE-2026-3358 | 2026-04-10 | Advisory |
| High 7.5 | <= 3.9.7 | 3.9.8 | CVE-2026-3360 | 2026-04-09 | Advisory |
| Medium 4.3 | <= 3.9.4 | 3.9.5 | CVE-2025-32223 | 2026-03-16 | Advisory |
| Medium 4.3 | <= 3.9.7 | 3.9.8 | CVE-2026-40740 | 2026-03-15 | Advisory |
| High 7.5 | <= 3.9.6 | 3.9.7 | CVE-2025-13673 | 2026-02-27 | Advisory |
| Medium 4.3 | <= 3.9.5 | 3.9.6 | CVE-2026-23799 | 2026-02-25 | Advisory |
| Medium 5.3 | <= 3.9.5 | 3.9.6 | CVE-2026-1371 | 2026-02-02 | Advisory |
| High 8.1 | <= 3.9.5 | 3.9.6 | CVE-2026-1375 | 2026-02-02 | Advisory |
| Medium 5.4 | <= 3.9.4 | 3.9.5 | CVE-2026-0548 | 2026-01-20 | Advisory |
| Medium 4.3 | <= 3.9.3 | 3.9.4 | CVE-2025-13628 | 2026-01-08 | Advisory |
| Medium 4.3 | <= 3.9.2 | 3.9.4 | CVE-2025-13935 | 2026-01-08 | Advisory |
| Medium 4.3 | <= 3.9.3 | 3.9.4 | CVE-2025-13934 | 2026-01-08 | Advisory |
| Medium 6.5 | <= 3.9.3 | 3.9.4 | CVE-2025-13679 | 2026-01-07 | Advisory |
| Medium 4.3 | <= 3.9.4 | 3.9.5 | CVE-2025-47555 | 2026-01-02 | Advisory |
| Medium 4.3 | <= 3.8.3 | 3.9.0 | CVE-2025-6680 | 2025-10-24 | Advisory |
| Medium 5.3 | <= 3.8.3 | 3.9.0 | CVE-2025-11564 | 2025-10-24 | Advisory |
| Medium 4.9 | <= 3.7.4 | 3.8.0 | CVE-2025-58993 | 2025-09-09 | Advisory |
| Medium 4.3 | <= 3.4.0 | 3.4.1 | CVE-2025-32230 | 2025-04-07 | Advisory |
| High 7.5 | <= 2.7.6 | 2.7.7 | CVE-2024-10400 | 2024-11-20 | Advisory |
| Medium 5.3 | <= 2.7.6 | 2.7.7 | CVE-2024-10393 | 2024-11-20 | Advisory |
| Medium 4.3 | <= 2.7.4 | 2.7.5 | CVE-2023-2919 | 2024-09-09 | Advisory |
| High 7.2 | <= 2.7.2 | 2.7.3 | CVE-2024-43282 | 2024-08-16 | Advisory |
| Medium 5.5 | <= 2.7.3 | 2.7.4 | CVE-2024-43231 | 2024-08-09 | Advisory |
| Medium 5.3 | <= 2.7.3 | 2.7.4 | CVE-2024-43142 | 2024-08-07 | Advisory |
| Medium 4.3 | <= 2.7.2 | 2.7.3 | CVE-2024-39645 | 2024-08-01 | Advisory |
| Medium 5.5 | <= 2.7.2 | 2.7.3 | CVE-2024-37947 | 2024-07-10 | Advisory |
| Low 2.7 | <= 2.7.1 | 2.7.2 | CVE-2024-37266 | 2024-06-27 | Advisory |
| High 7.2 | <= 2.7.1 | 2.7.2 | CVE-2024-4902 | 2024-06-06 | Advisory |
| Medium 4.3 | <= 2.7.1 | 2.7.2 | CVE-2024-5438 | 2024-06-06 | Advisory |
| Medium 6.5 | <= 2.7.0 | 2.7.1 | CVE-2024-4279 | 2024-05-15 | Advisory |
| High 8.8 | <= 2.7.0 | 2.7.1 | CVE-2024-4318 | 2024-05-15 | Advisory |
| Critical 9.8 | <= 2.7.0 | 2.7.1 | CVE-2024-4223 | 2024-05-15 | Advisory |
| Medium 6.5 | <= 2.6.2 | 2.7.0 | CVE-2024-3553 | 2024-04-26 | Advisory |
| Medium 5.4 | <= 2.6.2 | 2.7.0 | CVE-2024-3994 | 2024-04-24 | Advisory |
| Medium 4.3 | <= 2.6.1 | 2.6.2 | CVE-2024-1503 | 2024-03-12 | Advisory |
| Medium 5.4 | <= 2.6.1 | 2.6.2 | CVE-2024-1502 | 2024-03-12 | Advisory |
| High 8.8 | <= 2.6.1 | 2.6.2 | CVE-2024-1751 | 2024-03-11 | Advisory |
| Medium 5.4 | <= 2.6.0 | 2.6.1 | CVE-2024-1128 | 2024-02-20 | Advisory |
| Medium 4.3 | <= 2.6.0 | 2.6.1 | CVE-2024-1133 | 2024-02-20 | Advisory |
| Medium 4.4 | <= 2.2.4 | 2.3.0 | CVE-2023-49829 | 2023-12-05 | Advisory |
| Medium 6.4 | <= 2.2.4 | 2.3.0 | CVE-2023-4805 | 2023-09-25 | Advisory |
| High 7.5 | <= 2.2.0 | 2.2.1 | CVE-2023-3133 | 2023-06-12 | Advisory |
| High 8.8 | <= 2.2.0 | 2.2.1 | CVE-2023-25800 | 2023-05-30 | Advisory |
| High 8.8 | <= 2.1.10 | 2.2.0 | CVE-2023-25990 | 2023-05-30 | Advisory |
| Critical 9.8 | <= 2.1.10 | 2.2.0 | CVE-2023-25700 | 2023-05-30 | Advisory |
| Medium 5.4 | <= 2.1.8 | 2.1.9 | CVE-2023-25799 | 2023-05-24 | Advisory |
| Medium 6.1 | <= 2.0.9 | 2.0.10 | CVE-2023-0236 | 2023-01-12 | Advisory |
| Medium 5.5 | <= 2.0.9 | 2.0.10 | CVE-2022-2563 | 2022-09-26 | Advisory |
| Medium 6.1 | 2.0.0 to 2.0.8 | 2.0.9 | none | 2022-08-22 | Advisory |
| High 7.2 | <= 1.9.11 | 1.9.12 | none | 2021-12-27 | Advisory |
| Medium 6.1 | <= 1.9.11 | 1.9.12 | CVE-2021-25017 | 2021-12-27 | Advisory |
| Medium 6.1 | <= 1.9.10 | 1.9.11 | CVE-2021-24873 | 2021-10-19 | Advisory |
| Medium 5.5 | < 1.9.9 | 1.9.9 | CVE-2021-24740 | 2021-09-20 | Advisory |
| Medium 6.1 | <= 1.9.5 | 1.9.6 | none | 2021-08-09 | Advisory |
| Medium 5.5 | <= 1.9.1 | 1.9.2 | CVE-2021-24455 | 2021-06-28 | Advisory |
| Medium 5.5 | <= 1.8.7 | 1.8.8 | CVE-2021-24242 | 2021-04-05 | Advisory |
| High 8.8 | < 1.7.7 | 1.7.7 | CVE-2021-24184 | 2021-03-15 | Advisory |
| Medium 6.5 | <= 1.8.2 | 1.8.3 | CVE-2021-24183 | 2021-03-15 | Advisory |
| Medium 6.5 | < 1.7.7 | 1.7.7 | CVE-2021-24185 | 2021-03-15 | Advisory |
| Medium 6.5 | < 1.7.7 | 1.7.7 | CVE-2021-24181 | 2021-03-15 | Advisory |
| High 8.8 | <= 1.8.2 | 1.8.3 | CVE-2021-24182 | 2021-03-15 | Advisory |
| High 8.8 | < 1.8.3 | 1.8.3 | CVE-2021-24186 | 2021-03-15 | Advisory |
| Medium 6.1 | <= 1.9.12 | 1.9.13 | none | 2021-01-10 | Advisory |
| High 8.8 | < 1.5.3 | 1.5.3 | CVE-2020-8615 | 2020-02-04 | Advisory |
Check if a site is affected
Enter a site address to see which version of Tutor LMS – eLearning and online course solution and other plugins it runs, and whether they match a known vulnerability.
Questions
Is the Tutor LMS – eLearning and online course solution plugin safe to use?
1 known issue(s) have no fix yet, so check the table above before using it.
How do I check which version of Tutor LMS – eLearning and online course solution my site runs?
In WordPress go to Plugins > Installed Plugins. From the outside, the free PluginPeek scan below reads the version from the site's public files.
How do I fix a vulnerable plugin?
Make a full backup, then update it from Dashboard > Updates and check the site afterwards. If you would rather not, we can do it for a fixed $99, paid after you have checked the site.
Check any WordPress site in one click while you browse: Add PluginPeek to Chrome