CVE-2026-93681: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in themeum Tutor LMS – eLearning and online course solution

CVE-2026-93681 is a stored cross-site scripting vulnerability in the Tutor LMS WordPress plugin affecting versions up to 4.1.0. The vulnerability arises from insufficient input sanitization and output escaping of the display_name parameter. An authenticated attacker with subscriber-level privileges or higher can inject malicious scripts that execute in the context of users who access pages containing the injected content. Exploitation requires the presence of a Legal Consent record for the attacker's user account, which causes a 'View Logs' button to appear in the wp-admin/users.php Consent Logs column, facilitating the attack vector.

Successful exploitation allows an authenticated low-privilege user to execute arbitrary JavaScript in the context of other users viewing the injected pages. This can lead to information disclosure, session hijacking, or other actions permitted by the victim's privileges. The vulnerability does not affect unauthenticated users and requires specific conditions (Legal Consent record) to be exploitable.

No official patch or fix is currently documented. Users should monitor the vendor's advisory channels for updates. Until a fix is available, restrict subscriber-level user capabilities where possible and avoid creating Legal Consent records that enable the attack vector. Review and sanitize user input related to display_name parameters if custom code is used.