Tutor Lms Elementor Addons Vulnerabilities

The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.0.0 This is due to missing capability checks on the `activate_tutor_free()` and `activate_elementor_free()` functions registered as `admin_action_*` handlers. This makes it possible for aut...

CVSS:

4.3

Affected:

up to 4.0.0

Fix:

No patched version reported

Disclosed:

Jul 20, 2026

CVE-2026-1372 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS Elementor Addons tutor-lms-elementor-addons allows Stored XSS.This issue affects Tutor LMS Elementor Addons: from n/a through <= 3.0.1.

Affected:

up to 3.0.1

Fix:

No patched version reported

Disclosed:

Dec 9, 2025

CVE-2025-63042 on NVD →

The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web script...

CVSS:

6.4

Affected:

up to 3.0.1

Fixed in:

3.0.2

Disclosed:

Nov 30, 2025

CVE-2025-63042 on NVD →

[en] Missing Authorization vulnerability in Themeum Tutor LMS Elementor Addons.This issue affects Tutor LMS Elementor Addons: from n/a through 2.1.5.

Affected:

up to 2.1.6

Fixed in:

2.1.6

Disclosed:

Dec 9, 2024

CVE-2024-53816 on NVD →

The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.1.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform a dependency plugin install.

CVSS:

4.3

Affected:

up to 2.1.5

Fixed in:

2.1.6

Disclosed:

Dec 2, 2024

CVE-2024-53816 on NVD →

[en] The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the install_etlms_dependency_plugin() function in all versions up to, and including, 2.1.5. This makes it possible for authenticated attackers, with Subscriber-level access and...

Affected:

up to 2.1.6

Fixed in:

2.1.6

Disclosed:

Nov 15, 2024

CVE-2024-10897 on NVD →

The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the install_etlms_dependency_plugin() function in all versions up to, and including, 2.1.5. This makes it possible for authenticated attackers, with Subscriber-level access and abov...

CVSS:

4.3

Affected:

up to 2.1.5

Fixed in:

2.1.6

Disclosed:

Nov 14, 2024

CVE-2024-10897 on NVD →

[en] The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'course_carousel_skin' attribute within the plugin's Course Carousel widget in all versions up to, and including, 2.1.4 due to insufficient input sanitization and output escaping on user supplied attributes. Th...

Affected:

up to 2.1.5

Fixed in:

2.1.5

Disclosed:

Aug 20, 2024

CVE-2024-5576 on NVD →

The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'course_carousel_skin' attribute within the plugin's Course Carousel widget in all versions up to, and including, 2.1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This ma...

CVSS:

6.4

Affected:

up to 2.1.4

Fixed in:

2.1.5

Disclosed:

Aug 19, 2024

CVE-2024-5576 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS Elementor Addons allows Stored XSS.This issue affects Tutor LMS Elementor Addons: from n/a through 2.1.3.

Affected:

up to 2.1.4

Fixed in:

2.1.4

Disclosed:

Mar 27, 2024

CVE-2024-29913 on NVD →

The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web script...

CVSS:

6.4

Affected:

up to 2.1.3

Fixed in:

2.1.4

Disclosed:

Mar 25, 2024

CVE-2024-29913 on NVD →