CVE-2025-63042

MediumCVSS 6.5

Published: 09/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

16th percentile - higher than 16% of all known CVEs

Summary

Stored XSS vulnerability in the Tutor LMS Elementor Addons plugin allows persistent injection of malicious script into the page. An attacker can exploit this to execute script in the victim's browser.

Risk Assessment

Risk of session hijacking, data theft, or unauthorized actions in the victim's context.

Recommendation

Update the Tutor LMS Elementor Addons plugin to a version newer than 3.0.1 if a patch is available.

Other vulnerabilities in Tutor LMS Elementor Addons

CVE-2026-1372Medium
The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.0.0. This is due to missing capability checks on the `activate_tutor_free()` and `activate_elementor_free()` functions registered as `admin_action_*` handlers. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate the Tutor LMS and Elementor plugins without proper authorization.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS Elementor Addons tutor-lms-elementor-addons allows Stored XSS.This issue affects Tutor LMS Elementor Addons: from n/a through <= 3.0.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS