Known vulnerabilities in Tutor LMS – eLearning and online course solution
A complete WordPress LMS plugin to create any eLearning website easily.
68Reported vulnerabilities
9.8Highest CVSS score
4.0.5Latest version
100,000+Active installs
What to do now
Update Tutor LMS – eLearning and online course solution to 4.0.6 or later.
68 of these have a fixed version available. Updating resolves them.
Reported vulnerabilities
| CVE | Severity | Exploit probability |
Affected versions | Fixed in | Published |
|---|---|---|---|---|---|
| CVE-2024-10400 | High | 83.1% | 2.7.6 and earlier | 2.7.7 |
November 21, 2024 |
| CVE-2023-3133 | High | 1.0% | Before 2.2.1 | 2.2.1 |
July 4, 2023 |
| CVE-2023-25700 | Critical | 0.8% | 2.1.10 and earlier | 2.2.0 |
May 30, 2023 |
| CVE-2024-1751 | High | 3.1% | Before 2.6.2 | 2.6.2 |
March 13, 2024 |
| CVE-2025-6184 | High | 0.4% | 0 to 3.7.0 (inclusive) | 3.7.1 |
August 13, 2025 |
| CVE-2023-25800 | High | 0.7% | 2.2.0 and earlier | 2.2.1 |
May 30, 2023 |
| CVE-2023-25990 | High | 0.7% | 2.1.10 and earlier | 2.2.0 |
May 30, 2023 |
| CVE-2026-1375 | High | 0.4% | 0 to 3.9.5 (inclusive) | 3.9.6 |
February 3, 2026 |
| CVE-2026-3360 | High | 0.6% | 0 to 3.9.7 (inclusive) | 3.9.8 |
April 10, 2026 |
| CVE-2026-19094 | High | 0.3% | Before 4.0.6 | 4.0.6 |
August 24, 2026 |
| CVE-2025-13673 | High | 0.5% | 0 to 3.9.6 (inclusive) | 3.9.7 |
February 28, 2026 |
| CVE-2024-43282 | High | 0.4% | 2.7.2 and earlier | 2.7.3 |
August 16, 2024 |
| CVE-2024-4902 | High | 0.5% | Before 2.7.2 | 2.7.2 |
June 7, 2024 |
| WF-66130071-668e-4692-afd3-5fcc9039f10f | High | — | 1.9.11 and earlier | 1.9.12 |
December 27, 2021 |
| CVE-2026-15022 | Medium | 0.6% | 0 to 4.0.0 (inclusive) | 4.0.1 |
July 16, 2026 |
| CVE-2024-4318 | Medium | 0.5% | Before 2.7.1 | 2.7.1 |
May 16, 2024 |
| CVE-2026-16759 | Medium | 0.4% | 0 to 4.0.5 (inclusive) | 4.0.6 |
August 28, 2026 |
| CVE-2026-19093 | Medium | 0.3% | Before 4.0.6 | 4.0.6 |
August 28, 2026 |
| CVE-2026-13443 | Medium | 0.4% | 0 to 3.9.13 (inclusive) | 3.9.14 |
July 1, 2026 |
| CVE-2026-6080 | Medium | 0.5% | 0 to 3.9.8 (inclusive) | 3.9.9 |
April 17, 2026 |
| CVE-2025-13679 | Medium | 0.2% | 0 to 3.9.3 (inclusive) | 3.9.4 |
January 8, 2026 |
| CVE-2024-4279 | Medium | 0.4% | Before 2.7.1 | 2.7.1 |
May 16, 2024 |
| CVE-2024-3553 | Medium | 0.5% | Before 2.7.0 | 2.7.0 |
May 2, 2024 |
| CVE-2021-24873 | Medium | 0.8% | Before 1.9.11 | 1.9.11 |
November 23, 2021 |
| WF-bcaf9b92-5e59-47c5-a04e-3ef5c53a2640 | Medium | — | 2.0.0 to 2.0.8 (inclusive) | 2.0.9 |
August 22, 2022 |
| WF-a0b14d91-f8f9-41df-b2eb-12792fb3a197 | Medium | — | 1.9.5 and earlier | 1.9.6 |
August 9, 2021 |
| WF-234a847b-3ffa-4c5c-9bba-39df227de0bc | Medium | — | 1.9.12 and earlier | 1.9.13 |
January 10, 2021 |
| CVE-2026-3358 | Medium | 0.4% | 0 to 3.9.7 (inclusive) | 3.9.8 |
April 11, 2026 |
| CVE-2026-0548 | Medium | 0.3% | 3.9.4 and earlier | 3.9.5 |
January 20, 2026 |
| CVE-2024-10393 | Medium | 0.6% | 2.7.6 and earlier | 2.7.7 |
November 21, 2024 |
| CVE-2024-43231 | Medium | 0.3% | 2.7.3 and earlier | 2.7.4 |
August 9, 2024 |
| CVE-2024-37947 | Medium | 0.4% | 2.7.2 and earlier | 2.7.3 |
July 10, 2024 |
| CVE-2024-3994 | Medium | 0.4% | Before 2.7.0 | 2.7.0 |
April 25, 2024 |
| CVE-2023-25799 | Medium | 0.5% | 2.1.8 and earlier | 2.1.9 |
May 24, 2023 |
| CVE-2026-6965 | Medium | 0.3% | 0 to 3.9.9 (inclusive) | 3.9.10 |
May 13, 2026 |
| CVE-2026-40743 | Medium | 0.3% | 3.9.7 and earlier | 3.9.8 |
April 20, 2026 |
| CVE-2026-5502 | Medium | 0.5% | 0 to 3.9.8 (inclusive) | 3.9.9 |
April 17, 2026 |
| CVE-2026-1371 | Medium | 0.3% | 0 to 3.9.5 (inclusive) | 3.9.6 |
February 3, 2026 |
| CVE-2025-6639 | Medium | 0.2% | 0 to 3.8.3 (inclusive) | 3.9.0 |
October 25, 2025 |
| CVE-2025-11564 | Medium | 0.3% | 0 to 3.8.3 (inclusive) | 3.9.0 |
October 25, 2025 |
| CVE-2024-43142 | Medium | 0.4% | 2.7.3 and earlier | 2.7.4 |
August 7, 2024 |
| CVE-2026-15444 | Medium | 0.3% | 0 to 4.0.1 (inclusive) | 4.0.2 |
July 28, 2026 |
| CVE-2026-10736 | Medium | 0.5% | 0 to 3.9.11 (inclusive) | 3.9.12 |
June 18, 2026 |
| CVE-2025-58993 | Medium | 0.3% | 3.7.4 and earlier | 3.8.0 |
September 9, 2025 |
| CVE-2023-49829 | Medium | 0.4% | 2.2.4 and earlier | 2.3.0 |
December 5, 2023 |
| CVE-2026-14187 | Medium | 0.2% | 4.0.5 and earlier | 4.0.6 |
August 20, 2026 |
| CVE-2026-14306 | Medium | 0.2% | 0 up to (but not including) 3.9.14 | 3.9.14 |
August 6, 2026 |
| CVE-2026-14310 | Medium | 0.2% | Before 4.0.0 | 4.0.0 |
July 30, 2026 |
| CVE-2026-57694 | Medium | 0.3% | 3.9.13 and earlier | 3.9.14 |
July 6, 2026 |
| CVE-2026-12275 | Medium | 0.3% | 3.9.12 and earlier | 3.9.13 |
June 22, 2026 |
| CVE-2026-12273 | Medium | 0.3% | 3.9.12 and earlier | 3.9.13 |
June 22, 2026 |
| CVE-2026-12271 | Medium | 0.3% | 3.9.12 and earlier | 3.9.13 |
June 22, 2026 |
| CVE-2026-3371 | Medium | 0.4% | 0 to 3.9.7 (inclusive) | 3.9.8 |
April 11, 2026 |
| CVE-2025-32223 | Medium | 0.3% | 3.9.4 and earlier | 3.9.5 |
March 16, 2026 |
| CVE-2026-40740 | Medium | 0.2% | 3.9.7 and earlier | 3.9.8 |
March 15, 2026 |
| CVE-2026-23799 | Medium | 0.3% | 3.9.5 and earlier | 3.9.6 |
February 25, 2026 |
| CVE-2025-13935 | Medium | 0.2% | 0 to 3.9.2 (inclusive) | 3.9.4 |
January 9, 2026 |
| CVE-2025-13934 | Medium | 0.2% | 0 to 3.9.3 (inclusive) | 3.9.4 |
January 9, 2026 |
| CVE-2025-13628 | Medium | 0.2% | 0 to 3.9.3 (inclusive) | 3.9.4 |
January 9, 2026 |
| CVE-2025-47555 | Medium | 0.3% | 3.9.4 and earlier | 3.9.5 |
January 2, 2026 |
| CVE-2025-6680 | Medium | 0.2% | 0 to 3.8.3 (inclusive) | 3.9.0 |
October 25, 2025 |
| CVE-2025-32230 | Medium | 0.3% | 3.4.0 and earlier | 3.4.1 |
April 7, 2025 |
| CVE-2023-2919 | Medium | 0.2% | Before 2.7.5 | 2.7.5 |
September 10, 2024 |
| CVE-2024-39645 | Medium | 0.2% | 2.7.2 and earlier | 2.7.3 |
August 1, 2024 |
| CVE-2024-5438 | Medium | 0.3% | Before 2.7.2 | 2.7.2 |
June 7, 2024 |
| CVE-2024-1503 | Medium | 0.2% | Before 2.6.2 | 2.6.2 |
March 21, 2024 |
| CVE-2024-1128 | Low | 0.5% | Before 2.6.1 | 2.6.1 |
February 29, 2024 |
| CVE-2024-37266 | Low | 0.6% | 2.7.1 and earlier | 2.7.2 |
June 27, 2024 |