CVE-2026-88963 themeum CVE debrief

Who should care

WordPress site administrators and security teams should assess exposure and prioritize remediation because the vulnerability allows unauthenticated attackers to inject arbitrary web scripts. These scripts can execute in the victim's browser when they access a page with the malicious payload, potentially leading to unauthorized actions or data breaches. Remediation is crucial to prevent potential security incidents.

Why it matters

CVE-2026-88963 is a DOM-Based Cross-Site Scripting vulnerability in Tutor LMS that allows unauthenticated attackers to inject arbitrary web scripts. WordPress site administrators and security teams should assess exposure and prioritize remediation.

• Unauthenticated attackers can inject arbitrary web scripts that execute in the victim's browser
• Victims accessing a page with the malicious payload can be affected
• Remediation priority for WordPress site administrators and security teams

Technical summary

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via the 'redirect_url' parameter in versions up to, and including, 4.0.8. This is due to insufficient input validation in the Topbar component's back button handler. The vulnerability allows unauthenticated attackers to inject arbitrary web scripts that execute in the victim's browser whenever the victim accesses a page that includes the malicious payload. The CVSS score for this vulnerability is 6.1, indicating a medium severity.

Defensive priority

Medium priority for WordPress site administrators and security teams

Recommended defensive actions

• Update Tutor LMS to version 4.0.9 or later
• Review and validate user input for the 'redirect_url' parameter
• Implement additional security measures to prevent DOM-Based Cross-Site Scripting attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the DOM-Based Cross-Site Scripting vulnerability in Tutor LMS. The vulnerability is due to insufficient input validation in the Topbar component's back button handler. There are no known exploits or reports of this vulnerability being used in attacks. The CVE record was published on 2026-10-16T06:17:11.930Z and has not been modified since then. The NVD entry provides additional information on the vulnerability, including its CVSS score and severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.