CVE-2026-111407: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Themeum Tutor LMS

The vulnerability identified as CVE-2026-111407 in Themeum Tutor LMS is a stored cross-site scripting (XSS) flaw caused by improper neutralization of input during web page generation. This allows an attacker with low privileges and requiring user interaction to inject malicious scripts that can affect confidentiality, integrity, and availability to a limited extent. The affected versions include all Tutor LMS versions from initial release up to 4.1.2.

Successful exploitation of this vulnerability could lead to execution of arbitrary scripts in the context of the affected web application, potentially allowing attackers to steal sensitive information, manipulate content, or perform actions on behalf of other users. The CVSS vector indicates network attack vector, low attack complexity, requiring privileges and user interaction, with impacts on confidentiality, integrity, and availability rated as low to low-medium.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor Themeum's official channels for updates and apply patches once available. Until then, consider restricting user input and applying web application firewall rules to detect and block XSS payloads.