CVE-2026-88963: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in themeum Tutor LMS – eLearning and online course solution

CVE-2026-88963 describes a DOM-based Cross-Site Scripting vulnerability in the Tutor LMS – eLearning and online course solution WordPress plugin. The flaw exists in versions up to and including 4.0.8 due to improper neutralization of input in the 'redirect_url' parameter handled by the Topbar component's back button. An unauthenticated attacker can exploit this by crafting a malicious URL that injects arbitrary scripts executed in the context of the victim's browser upon page load.

Successful exploitation allows an attacker to execute arbitrary scripts in the victim's browser, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability requires user interaction (UI:R) and has a medium severity with limited confidentiality and integrity impact but no availability impact.

No official patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting access to affected plugin versions and avoid clicking suspicious links containing crafted 'redirect_url' parameters.