CVE-2021-24455: The Tutor LMS – eLearning and online course solution WordPress plugin before 1.9.2 did not escape the Summary field of Announcements (when outputting it in an attribute), which can be created by users

medium Affects tutor-lms (WordPress plugin). Feed 2026.10.29.4, updated 2026-10-29; published 2021-08-02; advisory modified 2026-06-17.

The Tutor LMS – eLearning and online course solution WordPress plugin before 1.9.2 did not escape the Summary field of Announcements (when outputting it in an attribute), which can be created by users

Package: tutor-lms (WordPress plugin) WordPress
Affected versions: <1.9.2
Fixed in: 1.9.2
Severity: medium CVSS 5.4
Exploitation: not on CISA KEV · EPSS 1% (54.8th percentile)
Published: 2021-08-02
Source: nvd

References

CWE-79

NVD record tutor-lms (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# PHP projects (recommended)
composer require --dev phpwarden/phpwarden
# then
vendor/bin/phpwarden wordpress /var/www/html

# or, without Composer
pipx install phpwarden   &&   phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2020-8615 medium A CSRF vulnerability in the Tutor LMS plugin before 1.5.3 for WordPress can result in an a same package: tutor-lms (WordPress plugin)
CVE-2021-24182 medium The tutor_quiz_builder_get_answers_by_question AJAX action from the Tutor LMS – eLearning same package: tutor-lms (WordPress plugin)
CVE-2021-24183 medium The tutor_quiz_builder_get_question_form AJAX action from the Tutor LMS – eLearning and on same package: tutor-lms (WordPress plugin)
CVE-2021-24184 high Several AJAX endpoints in the Tutor LMS – eLearning and online course solution WordPress p same package: tutor-lms (WordPress plugin)
CVE-2023-0236 medium The Tutor LMS WordPress plugin before 2.0.10 does not sanitise and escape the reset_key an same package: tutor-lms (WordPress plugin)
CVE-2021-24181 medium The tutor_mark_answer_as_correct AJAX action from the Tutor LMS – eLearning and online cou same package: tutor-lms (WordPress plugin)