Vulnerability history

Cross Site Scripting (XSS) vulnerability

Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover vulnerability

Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting vulnerability

Unauthenticated Tutor Page Force-Publish and Content Overwrite vulnerability

Instructor+ Arbitrary Post Reparenting vulnerability

Race Condition vulnerability

Cross Site Scripting (XSS) vulnerability

Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion vulnerability

Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters vulnerability

Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id' Parameter vulnerability

Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameter vulnerability

Read-Only API Key Privilege Escalation vulnerability

Subscriber+ Cross-Course Lesson Comment Disclosure vulnerability

Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution vulnerability

Instructor+ Arbitrary File Read vulnerability

Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters vulnerability

Unauthenticated SQLi vulnerability

Subscriber+ Paid Course Content Disclosure via Enrollment Check Bypass vulnerability

Instructor+ Cross-Instructor Private Course Disclosure vulnerability

Subscriber+ Cross-Course Q&A Content Disclosure and Reply Injection vulnerability

Authenticated (Administrator+) SQL Injection vulnerability

Insecure Direct Object References (IDOR) vulnerability

Authenticated (Author+) Stored Cross-Site Scripting vulnerability

Authenticated (Administrator+) SQL Injection vulnerability

Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Post Deletion vulnerability

Broken Access Control vulnerability

Authenticated (Admin+) SQL Injection via 'date' Parameter vulnerability

Authenticated (Subscriber+) Arbitrary Course Content Manipulation via tutor_update_course_content_order vulnerability

Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Course Content Modification vulnerability

Missing Authorization to Authenticated (Subscriber+) Unauthorized Private Course Enrollment vulnerability

Missing Authorization to Unauthenticated Arbitrary Billing Profile Overwrite via 'order_id' Parameter vulnerability

Insecure Direct Object References (IDOR) vulnerability

Broken Access Control vulnerability

Unauthenticated SQL Injection via coupon_code vulnerability

Broken Access Control vulnerability

Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Course Modification and Deletion vulnerability

Authenticated (Subscriber+) Information Disclosure in Coupon Details via 'tutor_coupon_details' AJAX Action vulnerability

Missing Authorization to Authenticated (Subscriber+) Arbitrary Course Completion vulnerability

WordPress Tutor LMS - eLearning and online course solution plugin <= 3.9.4 - Missing Authorization to Authenticated (Subscriber+) Limited Attachment Deletion vulnerability

WordPress Tutor LMS - eLearning and online course solution plugin <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Coupon Modification vulnerability

WordPress Tutor LMS - eLearning and online course solution plugin <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Course Enrollment Bypass vulnerability

Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via tutor_order_details vulnerability

Insecure Direct Object References (IDOR) vulnerability

Missing Authorization to Sensitive Information Exposure vulnerability

Missing Authorization to Unauthenticated Payment Status Update vulnerability

SQL Injection Vulnerability

HTML Injection vulnerability

Unauthenticated SQL Injection via rating_filter vulnerability

User Registration Setting Bypass to Unauthorized User Registration vulnerability

Cross-Site Request Forgery via 'addon_enable_disable' vulnerability

SQL Injection vulnerability

Cross Site Scripting (XSS) vulnerability

Broken Access Control vulnerability

Cross Site Request Forgery (CSRF) vulnerability

Cross Site Scripting (XSS) vulnerability

Path Traversal vulnerability

SQL Injection vulnerability

Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Quiz Attempt Deletion vulnerability

Missing Authorization vulnerability

Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Course Deletion vulnerability

Authenticated (Instructor+) SQL Injection vulnerability

Missing Authorization to Unauthenticated Limited Options Update vulnerability

Authenticated (Contributor+) Stored Cross-Site Scripting via 'tutor_instructor_list' Shortcode vulnerability

Cross-Site Request Forgery to Plugin Deactivation and Data Erase vulnerability

Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion vulnerability

Authenticated (Subscriber+) SQL Injection vulnerability

Missing Authorization vulnerability

Authenticated(Student+) HTML Injection via Q&A vulnerability

Cross Site Scripting (XSS) vulnerability

Subscriber+ Stored Cross-Site Scripting vulnerability

Unauthenticated Access to Tutor LMS Lesson Resources via REST API vulnerability

Unauthenticated SQL Injection vulnerability

Multiple Student+ SQL Injection vulnerability

Multiple Tutor Instructor+ SQL Injection vulnerability

Multiple Broken Access Control vulnerabilities

Reflected Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting (XSS) vulnerability

Multiple Stored Cross-Site Scripting (XSS) vulnerabilities

Reflected Cross-Site Scripting (XSS) vulnerability

Authenticated Local File Inclusion vulnerability

Multiple Blind/Time-based SQL Injection (SQLi) vulnerabilities

Multiple Union SQL Injection (SQLi) vulnerabilities

Unprotected AJAX Action to Privilege Escalation vulnerability

Cross-Site Request Forgery (CSRF) vulnerability