CVE-2026-100193: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in themeum Tutor LMS – eLearning and online course solution

CVE-2026-100193 is a reflected cross-site scripting vulnerability in the Tutor LMS WordPress plugin up to and including version 4.1.0. The flaw exists because the 'tab' parameter is not properly sanitized or escaped before being used in page generation. An attacker can exploit this by crafting a URL with a malicious 'tab' value that executes arbitrary scripts in the context of the victim's browser. Exploitation requires the targeted lesson page to have an empty nav-items array, which bypasses the in_array() validation and allows the attacker-controlled input to reach the output sink.

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the context of a victim's browser when they visit a specially crafted URL. This can lead to limited confidentiality and integrity impacts such as theft of session tokens or manipulation of page content. The attack requires user interaction (clicking a link) and a specific page state, limiting its scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, users should avoid exposing lesson pages with empty nav-items arrays or restrict access to such pages. Monitoring vendor channels for updates is recommended.