CVE-2026-93681 themeum CVE debrief

Who should care

Defenders responsible for WordPress installations using the Tutor LMS plugin should assess exposure and prioritize verification and remediation efforts. This includes administrators, security teams, and developers who manage WordPress plugins and user accounts.

Why it matters

The Tutor LMS plugin vulnerability allows authenticated attackers to inject arbitrary web scripts, potentially leading to code execution on injected pages. Defenders should verify exposure, prioritize remediation, and monitor user accounts and Legal Consent records.

• Verification of plugin version and Legal Consent record existence is necessary to determine exposure.
• Injection of arbitrary web scripts can lead to unauthorized code execution on injected pages.
• Exploitation requires authenticated access with subscriber-level permissions and above.
• Remediation priority is medium due to the CVSS score of 6.4 and the potential for code execution.

Technical summary

The Tutor LMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the display_name parameter in all versions up to, and including, 4.1.0. This is due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access and above can inject arbitrary web scripts into pages, which will execute when a user accesses an injected page. The vulnerability requires a Legal Consent record to exist for the attacker's user account, causing the View Logs button to appear in the wp-admin/users.php Consent Logs column. Defenders should prioritize verifying the existence of this vulnerability in their WordPress installations, especially if the Tutor LMS plugin is used,

Defensive priority

Defenders should prioritize verifying the existence of this vulnerability in their WordPress installations, especially if the Tutor LMS plugin is used, and ensure that the plugin is updated to a version that addresses this issue.

Recommended defensive actions

• Verify the existence of the Tutor LMS plugin in your WordPress installation and check if the version is 4.1.0 or earlier.
• Ensure that the plugin is updated to a version that addresses this issue.
• Monitor user accounts and Legal Consent records to detect potential exploitation attempts.
• Review and update input sanitization and output escaping mechanisms for the display_name parameter.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, including its description, CVSS score, and affected versions. However, the corpus does not establish versions beyond 4.1.0, exploitation, impact, or remediation, which require verification from the supplied official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.