CVE-2026-100193 themeum CVE debrief

Who should care

WordPress administrators and users of the Tutor LMS – eLearning and online course solution plugin should assess exposure and prioritize remediation. This includes reviewing and updating the plugin to a version greater than 4.1.0 if available, implementing additional security measures to mitigate potential attacks, and monitoring for suspicious activity. Security teams and vulnerability management teams should also review the vulnerability and implement a 7

Why it matters

CVE-2026-100193 is a Reflected Cross-Site Scripting vulnerability in Tutor LMS – eLearning and online course solution plugin for WordPress. Defenders should assess exposure, prioritize remediation, and implement additional security measures to mitigate potential attacks.

• Unauthenticated attackers can inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
• The vulnerability requires the targeted lesson page to have an empty nav-items array, which can occur naturally when a lesson has no post content, no attachments, and comments are disabled or the viewer is not logged in.
• Defenders should verify the version of Tutor LMS – eLearning and online course solution and implement additional security measures to mitigate potential attacks.
• Remediation priority is medium due to the CVSS score of 4.7 and the potential for attackers to exploit this vulnerability.

Technical summary

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 4.1.0. This is due to insufficient input sanitization and output escaping. The vulnerability requires specific conditions to be exploitable, such as an empty nav-items array on the targeted lesson page, which can occur naturally in certain scenarios. Defenders should assess exposure and prioritize remediation based on the CVSS score of 4.7.

Defensive priority

Medium

Recommended defensive actions

• Review and update Tutor LMS – eLearning and online course solution to a version greater than 4.1.0 if available.
• Implement additional input validation and output escaping for the 'tab' parameter in affected versions.
• Monitor for suspicious activity and implement Content Security Policy (CSP) to mitigate potential attacks.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and source item provide details on the vulnerability in Tutor LMS – eLearning and online course solution plugin for WordPress. The vulnerability is a Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 4.1.0.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.