Input validation vulnerability in Tutor LMS – eLearning and online course solution 2.2.4

The Tutor LMS plugin for WordPress, which is a solution for creating online courses, is vulnerable to a type of attack called Stored Cross-Site Scripting. This type of attack can be done by people who have administrator access and is possible in all versions of the plugin up to version 2.2.4. It happens when the plugin does not properly sanitize or escape user input. The attacker can then inject web scripts into pages that will execute when a user visits the page. This vulnerability only affects multi-site installations and installations where the option “unfiltered_html” has been disabled.