This vulnerability in Themeum Tutor LMS (up to version 2.7.2) is classified as CWE-79, involving improper neutralization of input leading to stored Cross-site Scripting (XSS). An attacker with high privileges can inject malicious scripts that are stored and later executed when viewed by users. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, user interaction required, and impacts confidentiality, integrity, and availability at a low level. No official fix or patch has been disclosed yet.

Successful exploitation could allow an attacker with high privileges to execute arbitrary scripts in the context of the affected application, potentially leading to partial compromise of confidentiality, integrity, and availability of the system. However, exploitation requires user interaction and elevated privileges, limiting the risk scope. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high privilege access to trusted users only and monitor for suspicious activity related to input handling. Avoid exposing the vulnerable versions in untrusted environments.