Stored XSS in Tutor LMS WordPress Plugin via Lesson Attachment Title

Executive Summary

The Tutor LMS plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in the Lesson Attachment Title feature. This occurs because the plugin does not properly sanitize or escape input and output data. As a result, authenticated users with author-level access or higher can inject malicious scripts into pages. These scripts execute whenever any user views the affected page.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves Stored Cross-Site Scripting (XSS) via the Lesson Attachment Title in the Tutor LMS WordPress plugin. Detection typically involves checking for suspicious or malicious scripts injected into lesson attachment titles within the plugin's data.

Since the vulnerability requires authenticated author-level access or higher, detection can be performed by reviewing the database entries related to lesson attachments for unexpected script tags or JavaScript code.

A practical approach is to query the WordPress database for lesson attachment titles containing common XSS payload patterns such as <script> tags.

• Use a SQL query on the WordPress database to find suspicious content, for example: SELECT * FROM wp_postmeta WHERE meta_key LIKE '%lesson_attachment_title%' AND meta_value LIKE '%<script>%';
• Alternatively, use WP-CLI to search for suspicious content: wp db query "SELECT * FROM wp_postmeta WHERE meta_key LIKE '%lesson_attachment_title%' AND meta_value LIKE '%<script>%';"

Network detection of this vulnerability is difficult because it is a stored XSS triggered by authenticated users visiting injected pages. Monitoring HTTP responses for injected scripts when accessing lesson pages may help, but no specific network commands are provided.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with author-level access to inject arbitrary web scripts that execute in the context of other users viewing the affected pages. This can lead to theft of user credentials, session hijacking, defacement, or other malicious actions performed on behalf of the victim user.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should update the Tutor LMS plugin to a version later than 3.9.13 where the issue is fixed.

Additionally, restrict author-level access and above to trusted users only, as the vulnerability requires authenticated users with author-level permissions.

Implementing web application firewall (WAF) rules to detect and block suspicious script injections may also help reduce risk.

Useful 0 Not Useful 0