The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored…

Tutor LMS versions up to and including 3.9.13 fail to sanitize the *Lesson Attachment title* field before rendering it back to the browser. An authenticated user with Author-level (or above) WordPress role plus Tutor Instructor capability can drop a <script> payload into the attachment metadata; when any user — typically an administrator reviewing course content — loads the lesson page, the script executes in that user's browser context. Because the CVSS vector is S:C (scope changed), a payload firing in an admin session can steal cookies, mint nonces, or trigger admin-only AJAX endpoints, escalating to full site compromise via plugin install or user creation.

Themeum labeled this MEDIUM (6.4) and that is *fair on paper*. In real enterprise usage it lands lower: the pre-condition is a trusted, provisioned instructor account — an insider who already agreed to terms of use. XSS in an LMS is not a mass-exploitable perimeter bug; it is an insider-abuse and phishing-lure amplifier. The S:C / C:L / I:L split accurately reflects that this leaks *some* data and modifies *some* state, not that it hands over the box.

Why this verdict

• Requires authenticated Author + Instructor role — this is not an unauth internet-exploitable bug; the attacker is already a trusted user of the site.
• Two-victim chain — an admin or higher-priv user must actually browse the malicious lesson page for the payload to fire in a privileged session. In real enterprise LMS ops that step is rare.
• Blast radius is one WordPress site, not a fleet. Even a full site takeover via chained admin XSS compromises one tenant of one CMS instance.
• Role multiplier: the affected component is a *WordPress course plugin* — it is not an identity provider, hypervisor, CA, backup admin, kernel-mode agent, or network-edge appliance. There is no realistic high-value-role deployment where Tutor LMS itself sits on the identity or supply-chain plane. Floor is not raised.
• No KEV, no PoC, no in-the-wild as of 2026-07-02. EPSS for the historical class of Tutor LMS auth'd XSS remains sub-percentile.

Why not higher?

Not MEDIUM/HIGH because the vendor's 6.4 already priced in S:C and the two-victim chain, but on a 10k-host fleet the *authenticated-insider* precondition dominates: you would not wake up a SOC for an XSS that a hired instructor can trigger against admins who rarely visit instructor content. No exploit code, no KEV, no exposure signal to justify escalation.

Why not lower?

Not IGNORE because S:C is real — a chained admin-view can end in site takeover, and public course platforms that self-register instructors materially expand the attacker pool. Backlog patching is warranted, not deferral to end-of-life.

1. Restrict instructor role provisioning to HR-approved accounts — On enterprise LMS deployments, close self-service instructor signup and require IT-managed provisioning. Since verdict is LOW there is no noisgate mitigation SLA — apply as part of the 365-day remediation window, prioritizing sites with open instructor registration.
2. Deploy a WAF ruleset covering WP auth'd XSS (Wordfence, Patchstack mu-plugin, Cloudflare Managed Rules) — Blocks naive <script>, onerror=, and javascript: payloads in postmeta writes. Roll out during normal change windows within the 365-day noisgate remediation SLA.
3. Enforce MFA on all WP admin, editor, and instructor accounts — Kills the credential-stuffing takeover path to an existing instructor. Standard hygiene — deploy alongside patch rollout.
4. Add a strict Content-Security-Policy to WP admin and course pages — script-src 'self' with nonces blocks external payload loads and inline script execution — neutralizes the practical exfil path even if the sink is triggered.

Run this on an auditor workstation or CI runner with curl and network reach to the target WP site. It reads the plugin version from the public readme.txt. Invoke as: ./check-tutor-lms.sh https://lms.example.com. No credentials required.

#!/usr/bin/env bash
# noisgate CVE-2026-13443 check — Tutor LMS stored XSS via Lesson Attachment
# Usage: ./check-tutor-lms.sh <site-base-url>
# Exit: 0 PATCHED, 1 VULNERABLE, 2 UNKNOWN
set -u
SITE="${1:-}"
if [ -z "$SITE" ]; then
  echo "UNKNOWN: usage $0 <https://site>" >&2
  exit 2
fi
FIXED="3.9.14"
README_URL="${SITE%/}/wp-content/plugins/tutor/readme.txt"
BODY="$(curl -fsSL --max-time 10 "$README_URL" 2>/dev/null || true)"
if [ -z "$BODY" ]; then
  echo "UNKNOWN: cannot fetch $README_URL (plugin not present, blocked, or path hardened)"
  exit 2
fi
VER="$(echo "$BODY" | grep -iE '^Stable tag:' | head -n1 | awk -F: '{print $2}' | tr -d ' \r')"
if [ -z "$VER" ]; then
  echo "UNKNOWN: could not parse Stable tag from readme.txt"
  exit 2
fi
# semver compare
printf '%s\n%s\n' "$FIXED" "$VER" | sort -V | head -n1 | grep -qx "$FIXED"
if [ "$?" -eq 0 ] && [ "$VER" != "$FIXED" ] || [ "$VER" = "$FIXED" ]; then
  # VER >= FIXED
  echo "PATCHED: Tutor LMS version $VER >= $FIXED"
  exit 0
else
  echo "VULNERABLE: Tutor LMS version $VER < $FIXED (CVE-2026-13443)"
  exit 1
fi

Sources

1. TheHackerWire — CVE-2026-13443
2. WPScan — Tutor LMS vulnerability index
3. Patchstack — Tutor LMS vulnerabilities
4. CVE Details — Themeum Tutor LMS
5. SecAlerts — Themeum Tutor LMS latest
6. Threatpost — Tutor LMS security holes (context)
7. CWE-79 — Cross-site Scripting