CVE-2026-13443 is a stored cross-site scripting vulnerability (CWE-79) in the Tutor LMS WordPress plugin, specifically in the Lesson Attachment Title input. Versions up to and including 3.9.13 do not properly sanitize or escape input, allowing authenticated users with author-level privileges or above to inject arbitrary web scripts. These scripts execute in the context of users who access the compromised pages, potentially leading to session hijacking or other script-based attacks. The CVSS 3.1 base score is 6.4 (medium severity) with network attack vector, low attack complexity, low privileges required, no user interaction, and impacts confidentiality and integrity with no availability impact.

An attacker with author-level or higher privileges can inject persistent malicious scripts into lesson attachment titles. These scripts execute in the browsers of users who view the affected pages, potentially compromising user sessions or data confidentiality and integrity. There is no direct impact on availability. The vulnerability requires authenticated access but no user interaction to trigger the script execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, restrict author-level access to trusted users only and consider disabling or limiting the use of lesson attachment titles as a temporary workaround.