The Tutor LMS Elementor Addons plugin for WordPress contains a stored cross-site scripting vulnerability (CWE-79) in the 'course_carousel_skin' attribute of its Course Carousel widget. This vulnerability exists due to inadequate sanitization and escaping of user input, allowing authenticated users with contributor or higher privileges to inject arbitrary JavaScript code. When other users access pages containing the injected code, the scripts execute in their browsers. The vulnerability affects all versions up to and including 2.1.4. The CVSS 3.1 score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges at the contributor level, no user interaction, and partial impact on confidentiality and integrity but no impact on availability. There is no vendor advisory or patch information provided, and no known exploits have been reported.

An attacker with contributor-level access or higher can inject persistent malicious scripts into pages via the vulnerable attribute. These scripts execute in the context of users viewing the infected pages, potentially leading to unauthorized actions such as session hijacking or data theft limited to confidentiality and integrity impacts. Availability is not affected. The vulnerability requires authenticated access, limiting exposure to users with some level of trust within the WordPress environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Tutor LMS Elementor Addons plugin if feasible. Monitor for updates from the vendor (themeum) regarding patches or official mitigations.