CVE-2022-2563 — Tutor LMS < 2.0.10 - Admin+ Stored Cross-Site Scripting

CVE-2022-2563

Tutor LMS < 2.0.10 - Admin+ Stored Cross-Site Scripting PUBLISHED

Description (CNA)

The Tutor LMS WordPress plugin before 2.0.10 does not escape some course parameters, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Affected (CNA)

Vendor / product	Versions
Unknown / Tutor LMS – eLearning and online course solution	affected 2.0.10 before 2.0.10

CWE

CWE-79

References

https://wpscan.com/vulnerability/98cd761c-7527-4224-965d-d34472b5c19f

ADP enrichment

CVE

No English description supplied.

https://wpscan.com/vulnerability/98cd761c-7527-4224-965d-d34472b5c19f

CISA-ADP

No English description supplied.

No references supplied.