CVE-2026-89081

MediumCVSS 6.1/10Last modified Sep 21, 2026

Description

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in all versions up to, and including, 4.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Sep 19, 2026
Last modified: Sep 21, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-890829.3HP has identified potential security vulnerabilities in the HP Advance software that may enable elevation of privilege, remote code executio CVE-2026-890839.3HP has identified potential security vulnerabilities in the HP Advance software that may enable elevation of privilege, remote code executio CVE-2026-890848.8HP has identified potential security vulnerabilities in the HP Advance software that may enable elevation of privilege, remote code executio CVE-2026-890856.6A flaw was found in parted. A heap-based buffer overflow can occur when processing a specially crafted FAT32 filesystem due to an integer ca CVE-2026-890869.1In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and pro CVE-2026-890877.3The cstruct package before 6.3.0 for OCaml mishandles indexes.CVE-2026-890885.5A flaw was found in parted. A heap-based buffer overflow exists in libparted's file system resizing logic when handling FAT16 volumes. By co CVE-2026-890896.5A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A lo CVE-2026-89094.3The WpMobi plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.0.3. This is due to miss CVE-2026-890905.9An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated CVE-2026-890918.8A flaw was found in ansible-core. When installing a collection with `ansible-galaxy collection install`, the archive extractor validates mem CVE-2026-890924.2The nscd service in the GNU C Library 2.3.4 onwards may crash due to a stack overflow when a malicious DNS server returns too large a respo