CVE-2026-89081: Tutor LMS WordPress Plugin XSS Vulnerability

CVE-2026-89081 Overview

CVE-2026-89081 is a Reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Tutor LMS eLearning and online course solution plugin for WordPress. The flaw affects all versions up to and including 4.0.8. It stems from insufficient input sanitization and output escaping on the search parameter. Unauthenticated attackers can inject arbitrary web scripts that execute in a victim's browser when the victim clicks a crafted link. Successful exploitation can lead to session theft, credential harvesting, forced administrative actions, or redirection to attacker-controlled sites.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in the context of any user who clicks a malicious link, enabling account takeover on affected WordPress sites running Tutor LMS.

Affected Products

Tutor LMS – eLearning and online course solution plugin for WordPress
All versions up to and including 4.0.8
WordPress sites that expose the Tutor LMS dashboard or search filter components

Discovery Timeline

2026-09-19 - CVE-2026-89081 published to the National Vulnerability Database
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-89081

Vulnerability Analysis

The vulnerability is a Reflected Cross-Site Scripting flaw affecting the Tutor LMS plugin for WordPress. The plugin reads the search query parameter and reflects it into rendered HTML without adequate sanitization or contextual output escaping. Because the attack vector is network-based and requires no authentication, any anonymous user on the internet can craft a malicious URL. The exploit does require user interaction: a victim must click the link or otherwise load the crafted URL. When executed, the injected script runs in the origin of the vulnerable WordPress site, granting the attacker access to cookies, session tokens, and the Document Object Model (DOM). Attackers can escalate a single click into administrative account takeover by targeting logged-in site administrators.

Root Cause

The root cause is missing input sanitization and missing output escaping on the search parameter across multiple template and component files. Affected code paths in version 4.0.7 include classes/Dashboard.php, components/SearchFilter.php, templates/account.php, and templates/dashboard/account/settings.php. Values from the search parameter are echoed into HTML attributes and page content without WordPress escaping helpers such as esc_attr() or esc_html().

Attack Vector

Exploitation requires an attacker to craft a URL containing a malicious payload in the search parameter and deliver it to a victim through phishing, forum posts, social media, or other social engineering channels. When the victim's browser loads the URL, the reflected payload executes within the vulnerable site's security context. See the Wordfence Vulnerability Report and the WordPress Tutor Changeset Overview for technical details on the vulnerable code and applied fix.

Detection Methods for CVE-2026-89081

Indicators of Compromise

Web server access logs showing requests to Tutor LMS dashboard or account URLs containing search= values with <script>, onerror=, onload=, javascript:, or URL-encoded equivalents (%3Cscript%3E).
Referrer headers pointing to external sites followed by requests to /dashboard/ or /account/ endpoints with unusual search payloads.
Reports from users of unexpected pop-ups, redirects, or session termination after clicking links to the WordPress site.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that flag reflected script content in the search query parameter on Tutor LMS routes.
Perform authenticated dynamic scans against staging instances using tools that fuzz the search parameter with XSS payloads.
Correlate WordPress audit logs with web server logs to identify administrator sessions that immediately follow suspicious search parameter requests.

Monitoring Recommendations

Monitor outbound requests from administrator browsers to unfamiliar domains that could indicate exfiltration of cookies or session tokens.
Alert on newly created WordPress administrator accounts, plugin installations, or theme file modifications following suspicious search parameter traffic.
Track user-reported phishing links referencing the WordPress site and inspect the associated URL parameters for XSS payloads.

How to Mitigate CVE-2026-89081

Immediate Actions Required

Update the Tutor LMS plugin to a version later than 4.0.8 that contains the fix from the WordPress Tutor Changeset Overview.
Force logout of all active WordPress sessions and rotate administrator passwords after patching.
Review recent administrator activity, installed plugins, and modified files for signs of unauthorized changes.

Patch Information

The vendor addressed the vulnerability in the Tutor LMS plugin update that follows version 4.0.8. The fix adds proper sanitization and output escaping to the search parameter across the affected files, including classes/Dashboard.php, components/SearchFilter.php, templates/account.php, and templates/dashboard/account/settings.php. Review the WordPress Tutor Dashboard Class and the WordPress Tutor Search Filter Component references for the pre-patch code locations.

Workarounds

Deploy a Web Application Firewall rule that blocks or sanitizes search parameter values containing HTML tags, event handlers, or javascript: URIs on Tutor LMS endpoints.
Apply a strict Content Security Policy (CSP) that disallows inline scripts to limit the impact of reflected payloads.
Restrict access to the Tutor LMS dashboard and account pages using network-level allowlists where feasible until the plugin is updated.

bash

# Example nginx rule to block obvious XSS payloads in the search parameter
if ($arg_search ~* "(<|%3C)\s*script|onerror=|onload=|javascript:") {
    return 403;
}