# themeum Tutor LMS – eLearning and online course solution.

Every CVE that names themeum Tutor LMS – eLearning and online course solution among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Tutor LMS <= 4.1.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via REST API Endpoints](https://agentprime.io/advisories/CVE-2026-93779.md)
  `CVE-2026-93779` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 6.5 Medium · Not analysed yet · Published 7 Nov 2026 · Tags: Broken access control
- [Tutor LMS <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover via 'ID' Parameter](https://agentprime.io/advisories/CVE-2026-92715.md)
  `CVE-2026-92715` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 4.3 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: Broken access control
- [Tutor LMS <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name Parameter](https://agentprime.io/advisories/CVE-2026-93681.md)
  `CVE-2026-93681` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 6.4 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Tutor LMS <= 4.0.8 - Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting via 'redirect_url' Parameter](https://agentprime.io/advisories/CVE-2026-88963.md)
  `CVE-2026-88963` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 6.1 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Tutor LMS <= 4.1.0 - Reflected Cross-Site Scripting via 'tab' Parameter](https://agentprime.io/advisories/CVE-2026-100193.md)
  `CVE-2026-100193` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 4.7 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [Tutor LMS <= 4.0.7 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via 'payload' Parameter](https://agentprime.io/advisories/CVE-2026-18439.md)
  `CVE-2026-18439` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 4.3 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Broken access control
- [Tutor LMS <= 4.0.8 - Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters](https://agentprime.io/advisories/CVE-2026-89081.md)
  `CVE-2026-89081` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 6.1 Medium · Not analysed yet · Published 19 Sept 2026 · Tags: Cross-site scripting (XSS)
- [Tutor LMS <= 4.0.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id' Parameter](https://agentprime.io/advisories/CVE-2026-88944.md)
  `CVE-2026-88944` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 4.3 Medium · Not analysed yet · Published 19 Sept 2026 · Tags: Broken access control
- [Tutor LMS <= 4.0.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameter](https://agentprime.io/advisories/CVE-2026-89333.md)
  `CVE-2026-89333` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 6.5 Medium · Not analysed yet · Published 19 Sept 2026 · Tags: Broken access control
- [Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution](https://agentprime.io/advisories/CVE-2026-78175.md)
  `CVE-2026-78175` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 8.8 High · Not analysed yet · Published 12 Sept 2026 · Tags: Insecure deserialization
- [Tutor LMS <= 4.0.5 - Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters](https://agentprime.io/advisories/CVE-2026-16759.md)
  `CVE-2026-16759` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 6.5 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: Other injection
- [Tutor LMS <= 4.0.1 - Authenticated (Administrator+) SQL Injection via 'coupon_code' Parameter](https://agentprime.io/advisories/CVE-2026-15444.md)
  `CVE-2026-15444` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 4.9 Medium · Not analysed yet · Published 28 Jul 2026 · Tags: SQL injection
- [Tutor LMS <= 4.0.0 - Authenticated (Subscriber+) SQL Injection via Stored Quiz Answer Array](https://agentprime.io/advisories/CVE-2026-15022.md)
  `CVE-2026-15022` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 6.5 Medium · Not analysed yet · Published 16 Jul 2026 · Tags: SQL injection
- [Tutor LMS <= 3.9.13 - Authenticated (Author+) Stored Cross-Site Scripting via Lesson Attachment Title](https://agentprime.io/advisories/CVE-2026-13443.md)
  `CVE-2026-13443` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 6.4 Medium · Not analysed yet · Published 1 Jul 2026 · Tags: Cross-site scripting (XSS)
- [Tutor LMS <= 3.9.11 - Authenticated (Administrator+) SQL Injection via 'data' Parameter](https://agentprime.io/advisories/CVE-2026-10736.md)
  `CVE-2026-10736` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 4.9 Medium · Not analysed yet · Published 18 Jun 2026 · Tags: SQL injection
- [Tutor LMS <= 3.9.9 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Post Deletion via 'course' GET Parameter](https://agentprime.io/advisories/CVE-2026-6965.md)
  `CVE-2026-6965` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 5.3 Medium · Not analysed yet · Published 13 May 2026 · Tags: Broken access control
- [Tutor LMS <= 3.9.8 - Authenticated (Subscriber+) Arbitrary Course Content Manipulation via tutor_update_course_content_order](https://agentprime.io/advisories/CVE-2026-5502.md)
  `CVE-2026-5502` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 5.3 Medium · Not analysed yet · Published 17 Apr 2026 · Tags: Broken access control
- [Tutor LMS <= 3.9.8 - Authenticated (Admin+) SQL Injection via 'date' Parameter](https://agentprime.io/advisories/CVE-2026-6080.md)
  `CVE-2026-6080` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 6.5 Medium · Not analysed yet · Published 17 Apr 2026 · Tags: SQL injection
- [Tutor LMS <= 3.9.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Course Content Modification](https://agentprime.io/advisories/CVE-2026-3371.md)
  `CVE-2026-3371` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 4.3 Medium · Not analysed yet · Published 11 Apr 2026 · Tags: Broken access control
- [Tutor LMS <= 3.9.7 - Missing Authorization to Authenticated (Subscriber+) Unauthorized Private Course Enrollment](https://agentprime.io/advisories/CVE-2026-3358.md)
  `CVE-2026-3358` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 5.4 Medium · Not analysed yet · Published 11 Apr 2026 · Tags: Broken access control
- [Tutor LMS <= 3.9.7 - Missing Authorization to Unauthenticated Arbitrary Billing Profile Overwrite via 'order_id' Parameter](https://agentprime.io/advisories/CVE-2026-3360.md)
  `CVE-2026-3360` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 7.5 High · Not analysed yet · Published 10 Apr 2026 · Tags: Broken access control
- [Tutor LMS <= 3.9.6 - Unauthenticated SQL Injection via coupon_code](https://agentprime.io/advisories/CVE-2025-13673.md)
  `CVE-2025-13673` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 7.5 High · Not analysed yet · Published 28 Feb 2026 · Tags: SQL injection
- [Tutor LMS <= 3.9.5 - Authenticated (Subscriber+) Information Disclosure in Coupon Details via 'tutor_coupon_details' AJAX Action](https://agentprime.io/advisories/CVE-2026-1371.md)
  `CVE-2026-1371` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 5.3 Medium · Not analysed yet · Published 3 Feb 2026 · Tags: Information disclosure
- [Tutor LMS <= 3.9.5 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Course Modification and Deletion](https://agentprime.io/advisories/CVE-2026-1375.md)
  `CVE-2026-1375` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 8.1 High · Not analysed yet · Published 3 Feb 2026 · Tags: Broken access control
- [Tutor LMS – eLearning and online course solution <= 3.9.4 - Missing Authorization to Authenticated (Subscriber+) Limited Attachment Deletion](https://agentprime.io/advisories/CVE-2026-0548.md)
  `CVE-2026-0548` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 5.4 Medium · Not analysed yet · Published 20 Jan 2026 · Tags: Broken access control
- [Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Course Completion](https://agentprime.io/advisories/CVE-2025-13935.md)
  `CVE-2025-13935` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 4.3 Medium · Not analysed yet · Published 9 Jan 2026 · Tags: Broken access control
- [Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Course Enrollment Bypass](https://agentprime.io/advisories/CVE-2025-13934.md)
  `CVE-2025-13934` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 4.3 Medium · Not analysed yet · Published 9 Jan 2026 · Tags: Broken access control
- [Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Coupon Modification](https://agentprime.io/advisories/CVE-2025-13628.md)
  `CVE-2025-13628` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 4.3 Medium · Not analysed yet · Published 9 Jan 2026 · Tags: Broken access control
- [Tutor LMS <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via tutor_order_details](https://agentprime.io/advisories/CVE-2025-13679.md)
  `CVE-2025-13679` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 6.5 Medium · Not analysed yet · Published 8 Jan 2026 · Tags: Broken access control
- [Tutor LMS – eLearning and online course solution <= 3.8.3 - Missing Authorization to Unauthenticated Payment Status Update](https://agentprime.io/advisories/CVE-2025-11564.md)
  `CVE-2025-11564` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 5.3 Medium · Not analysed yet · Published 25 Oct 2025 · Tags: Broken access control
- [Tutor LMS <= 3.8.3 - Missing Authorization to Sensitive Information Exposure](https://agentprime.io/advisories/CVE-2025-6680.md)
  `CVE-2025-6680` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 4.3 Medium · Not analysed yet · Published 25 Oct 2025 · Tags: Broken access control
- [Tutor LMS <= 2.7.6 - Unauthenticated SQL Injection via rating_filter](https://agentprime.io/advisories/CVE-2024-10400.md)
  `CVE-2024-10400` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.83 · Not analysed yet · Published 21 Nov 2024 · Tags: SQL injection
- [Tutor LMS <= 2.7.6 - User Registration Setting Bypass to Unauthorized User Registration](https://agentprime.io/advisories/CVE-2024-10393.md)
  `CVE-2024-10393` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 5.3 Medium · Not analysed yet · Published 21 Nov 2024 · Tags: Broken access control
- [Tutor LMS <= 2.7.4 - Cross-Site Request Forgery via 'addon_enable_disable'](https://agentprime.io/advisories/CVE-2023-2919.md)
  `CVE-2023-2919` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 4.3 Medium · Not analysed yet · Published 10 Sept 2024 · Tags: Cross-site request forgery (CSRF)
- [Tutor LMS – eLearning and online course solution <= 2.7.1 - Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Quiz Attempt Deletion](https://agentprime.io/advisories/CVE-2024-5438.md)
  `CVE-2024-5438` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 4.3 Medium · Not analysed yet · Published 7 Jun 2024 · Tags: Broken access control
- [Tutor LMS – eLearning and online course solution <= 2.7.1 -Authenticated (Administrator+) SQL Injection](https://agentprime.io/advisories/CVE-2024-4902.md)
  `CVE-2024-4902` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 7.2 High · Not analysed yet · Published 7 Jun 2024 · Tags: SQL injection
- [Tutor LMS <= 2.7.0 - Missing Authorization](https://agentprime.io/advisories/CVE-2024-4223.md)
  `CVE-2024-4223` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 May 2024 · Tags: Broken access control
- [Tutor LMS <= 2.7.0 - Authenticated (Instructor+) SQL Injection](https://agentprime.io/advisories/CVE-2024-4318.md)
  `CVE-2024-4318` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 8.8 High · Not analysed yet · Published 16 May 2024 · Tags: SQL injection
- [Tutor LMS – eLearning and online course solution <= 2.7.0 - Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Course Deletion](https://agentprime.io/advisories/CVE-2024-4279.md)
  `CVE-2024-4279` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 6.5 Medium · Not analysed yet · Published 16 May 2024 · Tags: Broken access control
- [Tutor LMS <= 2.6.2 - Missing Authorization to Unauthenticated Limited Options Update](https://agentprime.io/advisories/CVE-2024-3553.md)
  `CVE-2024-3553` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 6.5 Medium · Not analysed yet · Published 2 May 2024 · Tags: Broken access control
- [Tutor LMS – eLearning and online course solution <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tutor_instructor_list' Shortcode](https://agentprime.io/advisories/CVE-2024-3994.md)
  `CVE-2024-3994` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 5.4 Medium · Not analysed yet · Published 25 Apr 2024 · Tags: Cross-site scripting (XSS)
- [Tutor LMS – eLearning and online course solution <= 2.6.1 - Authenticated (Subscriber+) SQL Injection](https://agentprime.io/advisories/CVE-2024-1751.md)
  `CVE-2024-1751` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 8.8 High · Not analysed yet · Published 13 Mar 2024 · Tags: SQL injection
- [Tutor LMS – eLearning and online course solution <= 2.6.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion](https://agentprime.io/advisories/CVE-2024-1502.md)
  `CVE-2024-1502` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 5.4 Medium · Not analysed yet · Published 12 Mar 2024 · Tags: Broken access control
- [Tutor LMS – eLearning and online course solution <= 2.6.1 - Cross-Site Request Forgery to Plugin Deactivation and Data Erase](https://agentprime.io/advisories/CVE-2024-1503.md)
  `CVE-2024-1503` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 4.3 Medium · Not analysed yet · Published 12 Mar 2024 · Tags: Cross-site request forgery (CSRF)
- [Tutor LMS <= 2.6.0 - Missing Authorization](https://agentprime.io/advisories/CVE-2024-1133.md)
  `CVE-2024-1133` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 4.3 Medium · Not analysed yet · Published 20 Feb 2024 · Tags: Broken access control
- [Tutor LMS <= 2.6.0 - Authenticated(Student+) HTML Injection via Q&A](https://agentprime.io/advisories/CVE-2024-1128.md)
  `CVE-2024-1128` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 5.4 Medium · Not analysed yet · Published 20 Feb 2024 · Tags: Other injection
- [WordPress Tutor LMS Plugin <= 2.2.4 is vulnerable to Cross Site Scripting (XSS)](https://agentprime.io/advisories/CVE-2023-49829.md)
  `CVE-2023-49829` · CVE record: Themeum Tutor LMS – eLearning and online course solution · CVSS 5.9 Medium · Not analysed yet · Published 15 Dec 2023 · Tags: Cross-site scripting (XSS)
- [Tutor LMS < 1.8.8 - Authenticated Local File Inclusion](https://agentprime.io/advisories/CVE-2021-24242.md)
  `CVE-2021-24242` · CVE record: Themeum Tutor LMS – eLearning and online course solution · No CVSS score · Not analysed yet · Published 22 Apr 2021 · Tags: Path traversal

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=themeum-tutor-lms-elearning-and-online-course-solution>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/themeum-tutor-lms-elearning-and-online-course-solution/>. Everything for agents: <https://agentprime.io/llms.txt>.