CVE-2026-13443

MEDIUM

Tutor LMS <= 3.9.13 - Authenticated (Author+) Stored Cross-Site Scripting via Lesson Attachment Title

Title source: cna

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-13443. PoCs published by HermesNA-1.

AI-analyzed exploit summary This repository contains an auto-generated stub module for CVE-2026-13443, a stored XSS vulnerability in the Tutor LMS WordPress plugin (versions ≤ 3.9.13). The code includes metadata, references, and a placeholder `run()` method but lacks actual exploit implementation.

Description

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Lesson Attachment Title in all versions up to, and including, 3.9.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Exploits (1)

github STUB 1 stars

by HermesNA-1 · pythonpoc

https://github.com/HermesNA-1/SnakeSploit/tree/main/data/modules_generated/cve-2026-13443_the_tutor_lms.py

View Code ZIP pw:eip

This repository contains an auto-generated stub module for CVE-2026-13443, a stored XSS vulnerability in the Tutor LMS WordPress plugin (versions ≤ 3.9.13). The code includes metadata, references, and a placeholder `run()` method but lacks actual exploit implementation.

Classification

Stub 99%

Attack Type

Xss

Complexity

Moderate

Reliability

Theoretical

Target: Tutor LMS – eLearning and online course solution plugin for WordPress (versions up to and including 3.9.13)

No auth needed

Prerequisites: Access to a WordPress site with a vulnerable version of Tutor LMS installed · Ability to create or modify lesson attachments with crafted titles

MITRE ATT&CK

T1059.007 - JavaScript T1189 - Drive-by Compromise

mistral-large-3 · analyzed Jul 09, 2026 Full analysis →