Themeum Tutor_lms
49 CVEs affecting Themeum Tutor_lms. Latest disclosed: 2025-10-25. Critical: 1, High: 16.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-4223 | Critical | 9.8 | 2024-05-16 | The Tutor LMS plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on multip… |
CVE-2024-4352 | High | 8.8 | 2024-05-16 | The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on th… |
CVE-2024-4351 | High | 8.8 | 2024-05-16 | The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on th… |
CVE-2024-4318 | High | 8.8 | 2024-05-16 | The Tutor LMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘question_id’ parameter in versions up to, and including, 2.7.0 due to ins… |
CVE-2024-1751 | High | 8.8 | 2024-03-13 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the question_id parameter in all versio… |
CVE-2021-24184 | High | 8.8 | 2021-04-05 | Several AJAX endpoints in the Tutor LMS – eLearning and online course solution WordPress plugin before 1.7.7 were unprotected, allowing students to modify cour… |
CVE-2023-25799 | High | 8.3 | 2024-06-11 | Missing Authorization vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a through 2.1.8. |
CVE-2023-25700 | High | 8.2 | 2023-11-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS allows SQL Injection.This issue affects… |
CVE-2023-25800 | High | 8.1 | 2023-11-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS allows SQL Injection.This issue affects… |
CVE-2024-43282 | High | 7.6 | 2024-08-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a… |
CVE-2024-37256 | High | 7.6 | 2024-07-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a… |
CVE-2024-10400 | High | 7.5 | 2024-11-21 | The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via the ‘rating_filter’ parameter in all versions up to, and including, 2.7.6 due to insuffic… |
CVE-2023-3133 | High | 7.5 | 2023-07-04 | The Tutor LMS WordPress plugin before 2.2.1 does not implement adequate permission checks for REST API endpoints, allowing unauthenticated attackers to access… |
CVE-2024-4222 | High | 7.3 | 2024-05-16 | The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on mu… |
CVE-2024-4902 | High | 7.2 | 2024-06-07 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the ‘course_id’ parameter in all versio… |
CVE-2024-5784 | High | 7.1 | 2024-08-30 | The Tutor LMS Pro plugin for WordPress is vulnerable to unauthorized administrative actions execution due to a missing capability checks on multiple functions… |
CVE-2023-25990 | High | 7.1 | 2023-11-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS allows SQL Injection.This issue affects… |
CVE-2024-43231 | Medium | 6.5 | 2024-08-12 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themeum Tutor LMS allows Stored XSS.This issue aff… |
CVE-2024-4279 | Medium | 6.5 | 2024-05-16 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference to Arbitrary Course Deletion in ver… |
CVE-2024-3553 | Medium | 6.5 | 2024-05-02 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check… |