What is CVE-2026-88963?

CVE-2026-88963 is a medium-severity vulnerability in Themeum Tutor Lms – Elearning And Online Course Solution, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2026-10-16.

How severe is CVE-2026-88963?

Medium severity. CVSS v3 base score is 6.1 out of 10.

XSS in Themeum Tutor Lms – Elearning And Online Course Solution

CVE-2026-88963

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via the 'redirect_url' parameter in versions up to, and including, 4.0.8 This is due to insufficient input validation in the Topbar component's back button handler. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in the victim's browser whenever the victim accesses a page that includes the malicious payload.

Vulnerability class: XSS (Cross-Site Scripting)

Published 2026-10-16 · last modified 2026-10-16.

CVSS v3 metric

CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Themeum Tutor Lms – Elearning And Online Course Solution

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

Frequently asked questions

What is CVE-2026-88963?: CVE-2026-88963 is a medium-severity vulnerability in Themeum Tutor Lms – Elearning And Online Course Solution, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2026-10-16.
How severe is CVE-2026-88963?: Medium severity. CVSS v3 base score is 6.1 out of 10.