Input validation vulnerability in Tutor LMS – eLearning and online course solution 2.0.9

The Tutor LMS plugin for WordPress has a security issue that could allow someone unauthenticated (not logged in) to inject malicious code into pages. This code could be executed if a user clicks on a link or does something else that the attacker wants. The versions of Tutor LMS that are affected are 2.0.9 and earlier. This is because of how the plugin handles certain parameters (reset_key and user_id) that are used for password retrieval. It does not properly sanitize the input or escape the output