CVE-2026-13443: Tutor LMS WordPress Plugin XSS Vulnerability

CVE-2026-13443 Overview

CVE-2026-13443 is a Stored Cross-Site Scripting (XSS) vulnerability in the Tutor LMS – eLearning and online course solution plugin for WordPress. The flaw affects all versions up to and including 3.9.13. It stems from insufficient input sanitization and output escaping on the Lesson Attachment Title field. Authenticated attackers with author-level access or higher can inject arbitrary JavaScript that executes in the browser of any user viewing an affected page. The weakness is tracked under CWE-79.

Critical Impact
Authenticated authors can persist malicious scripts in course pages, enabling session theft, account takeover, and unauthorized administrative actions when higher-privileged users view the injected content.

Affected Products

Tutor LMS – eLearning and online course solution plugin for WordPress
All versions up to and including 3.9.13
WordPress sites running the plugin with author-level (or higher) user registration enabled

Discovery Timeline

2026-07-01 - CVE-2026-13443 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-13443

Vulnerability Analysis

The vulnerability is a stored XSS issue in the Tutor LMS plugin's lesson attachment handling logic. When an author submits a lesson attachment, the plugin persists the attachment title without applying sufficient sanitization on input. The template rendering path in templates/global/attachments.php then outputs the stored title without adequate escaping. Any user visiting a lesson page that references the attachment executes the attacker-supplied script in the context of the site origin. Because the payload is stored server-side, every subsequent visitor is affected until the record is removed.

Root Cause

The root cause is missing input sanitization and missing output escaping in the attachment title data flow. The relevant code paths reside in classes/Utils.php around lines 1688 and 1720, and the rendering path in templates/global/attachments.php at line 34. See WordPress Tutor Utils Code and WordPress Tutor Attachments Code.

Attack Vector

Exploitation requires an authenticated account with at least author privileges on the target WordPress instance. The attacker creates or edits a lesson, attaches a file, and supplies a malicious JavaScript payload in the attachment title field. The payload is stored in the database and executed whenever the lesson page renders the attachment list. Because the scope is changed (S:C), the injected script can access resources beyond the vulnerable component, including WordPress admin session data when an administrator views the page.

No verified public proof-of-concept code has been published. Refer to the Wordfence Vulnerability Intelligence advisory for additional technical context.

Detection Methods for CVE-2026-13443

Indicators of Compromise

Lesson attachment records containing HTML tags such as <script>, <img onerror=>, or <svg onload=> in the title field.
Unexpected outbound requests from browsers of administrators or students visiting course pages, particularly to attacker-controlled domains.
New or modified administrator accounts, plugin installations, or theme changes shortly after author-level users edit lessons.

Detection Strategies

Query the WordPress database for Tutor LMS attachment metadata and flag entries whose title contains angle brackets, JavaScript URI schemes, or HTML event handlers.
Deploy a Web Application Firewall rule to inspect POST requests to Tutor LMS lesson editing endpoints for reflected script payloads in attachment title parameters.
Enable Content Security Policy (CSP) reporting on the WordPress site and monitor report-uri events for inline script violations on lesson URLs.

Monitoring Recommendations

Audit accounts with author, editor, or contributor roles and confirm each account is expected and active.
Review Tutor LMS lesson revisions and attachment records created or modified since the plugin was installed, especially by non-administrative authors.
Correlate WordPress access logs with browser telemetry from privileged users to identify anomalous script execution on lesson pages.

How to Mitigate CVE-2026-13443

Immediate Actions Required

Update the Tutor LMS plugin to a version later than 3.9.13 as soon as the vendor releases a patched build.
Restrict author-level account creation and review existing author, editor, and contributor accounts for legitimacy.
Purge or sanitize any existing lesson attachment titles that contain HTML or script content in the database.

Patch Information

The vendor committed a fix referenced in the plugin repository. Review the WordPress Tutor Changeset Update for the specific code changes addressing the sanitization and escaping gaps in Utils.php and attachments.php. Site owners should upgrade to the fixed release referenced in the Wordfence Vulnerability Intelligence advisory.

Workarounds

Temporarily disable the Tutor LMS plugin if upgrading is not immediately possible on production sites.
Remove author-level and higher privileges from untrusted users until the plugin is patched.
Deploy a strict Content Security Policy that blocks inline script execution on lesson and course pages.
Configure a WAF rule to strip or reject HTML characters in Tutor LMS attachment title parameters.

bash

# Example WordPress CLI commands to identify suspicious attachment titles
wp db query "SELECT ID, post_title, post_author FROM wp_posts \
  WHERE post_type = 'attachment' \
  AND (post_title LIKE '%<script%' \
       OR post_title LIKE '%onerror=%' \
       OR post_title LIKE '%javascript:%');"

# List non-administrator accounts with content creation privileges
wp user list --role=author --fields=ID,user_login,user_email,user_registered
wp user list --role=editor --fields=ID,user_login,user_email,user_registered

# Deactivate the plugin until patched
wp plugin deactivate tutor