Known vulnerabilities in the Tutor plugin
24 security advisories have been published for the Tutor plugin. Each entry below states what an attacker can do, what privilege they need, and the version the issue was fixed in.
- Tutor - Remote Code Execution (CVE-2026-16759) MEDIUM
- Tutor - SQL Injection (CVE-2026-15444) MEDIUM
- Tutor - SQL Injection (CVE-2026-15022) MEDIUM
- Tutor - Cross-Site Scripting (XSS) (CVE-2026-13443) MEDIUM
- Tutor - SQL Injection (CVE-2026-10736) MEDIUM
- Tutor - Security Vulnerability (CVE-2026-6965) MEDIUM
- Tutor - SQL Injection (CVE-2026-6080) MEDIUM
- Tutor - Broken Access Control (CVE-2026-5502) MEDIUM
- Tutor - Broken Access Control (CVE-2026-3358) MEDIUM
- Tutor - Broken Access Control (CVE-2026-3371) MEDIUM
- Tutor - Security Vulnerability (CVE-2026-3360) HIGH
- Tutor - Security Vulnerability (CVE-2026-1375) HIGH
- Tutor - Broken Access Control (CVE-2026-1371) MEDIUM
- Tutor - Security Vulnerability (CVE-2025-6639) MEDIUM
- Tutor - Broken Access Control (CVE-2025-11564) MEDIUM
- Tutor - SQL Injection (CVE-2025-6184) HIGH
- Tutor - Cross-Site Request Forgery (CSRF) (CVE-2023-2919) MEDIUM
- Tutor - Security Vulnerability (CVE-2024-5438) MEDIUM
- Tutor - SQL Injection (CVE-2024-4902) HIGH
- Tutor - SQL Injection (CVE-2024-4318) HIGH
- Tutor - Security Vulnerability (CVE-2024-4279) MEDIUM
- Tutor - Cross-Site Request Forgery (CSRF) (CVE-2024-1503) MEDIUM
- Tutor - SQL Injection (CVE-2024-1751) HIGH
- Tutor - Broken Access Control (CVE-2023-3133) HIGH