CVE-2026-89081 describes a reflected Cross-Site Scripting vulnerability in the Tutor LMS WordPress plugin, affecting all versions up to and including 4.0.8. The flaw exists because the 'search' parameter is not properly sanitized or escaped before being included in web pages, enabling attackers to inject malicious scripts. Exploitation requires tricking a user into clicking a crafted link, which then executes the injected script in the user's browser context.

Successful exploitation can lead to partial confidentiality and integrity impacts, as indicated by the CVSS vector (C:L/I:L/A:N). Attackers can execute arbitrary scripts in the context of the affected site, potentially leading to session hijacking, defacement, or other client-side attacks. There is no indication of availability impact. The vulnerability does not require authentication but does require user interaction.

No explicit patch or fix is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting the vulnerable functionality or applying web application firewall rules to filter malicious input targeting the 'search' parameter.