Plugin Pulse Beta
← Pulse

Tutor LMS – eLearning and online course solution

by Themeum · Education

Also makes 12 other plugins · 661.3K+ installs across the portfolio →

Try it live ↗ wp.org ↗

A complete WordPress LMS plugin to create any eLearning website easily.

Try it live opens a temporary test site in your browser, which can take about 20 seconds to load. Plugins that rely on outside services or a full server may not work completely there.

⚠ Open vulnerability

Health

B 79/100

Open vulnerability

Active installs

100K+

≈190K estimated

Momentum

+33%

downloads vs prior 30d

Biggest opportunity: Support resolution scores 52/100. Mark more forum threads resolved — the resolved ratio feeds the ranking.

See the detail → Get the free audit
How scoring works →
79 Health · B
Maintenance 100/100
Rating quality 86/100
Support 63/100
Security 40/100

79 health vs 69 average across 280 Education plugins

100K+

Active installs

≈190K estimated

4.7M

Total downloads

since 2019 · 2.1% still active

4.4/5

Rating

590 reviews · +0.4/wk

+33%

146.9K

Downloads · 30d

category median +21%

Install conversion

How it's measured →

2.1%

of downloads still active

At least 100K of 4.7M lifetime downloads are still running, above its category: the median Education plugin keeps 1.0%, across 176 plugins.

Downloads count every update, not just first installs, so older and more frequently released plugins read lower. Compare against other Education plugins, not across the directory. wp.org reports active installs as the bottom of a band, so the real rate is this or higher.

This plugin shipped 29 releases in the last 12 months, and every existing install that updated counted as another download. wp.org publishes no split between first installs and updates, so we show the raw rate rather than guess at one.

Ratings · 590 reviews

Read on wp.org ↗
5★
482 4★
13 3★
14 2★
20 1★
61

Details

Version
4.2.0
Last updated
4d ago
Added
2019-02-06 · 7 yrs old
Requires WP
5.3
Tested up to
7.1.4
Requires PHP
7.4
Changelog ↗Support forum ↗Reviews ↗Advanced stats ↗

Directory ranking optimization

How it's scored →

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

90 / 100

Excellent listing optimization

Most to gain: Support resolution

Update recency 100/100

Updated 4 days ago

WP compatibility 100/100

Tested up to WordPress 7.1.4, the current branch or newer

Rating quality 88/100

4.4★ over 590 reviews, smoothed to 4.38★

Listing tuning 100/100

5 of 5 tags set · short description in place

Support resolution 52/100

15 of 29 support threads resolved in the last 2 months

To rank higher: Mark more forum threads resolved — the resolved ratio feeds the ranking.

Get the full rank-higher report →

Daily downloads

Since 5 Oct 2022 · 1,488 days · wp.org + Plugin Pulse archive

+33% vs prior 30d
2.3K31 Oct 2026

30-day downloads

Rolling 30-day volume · peak 190.5K · peaks are release surges

146.3K31 Oct 2026

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

Tutor LMS · #462youLearnPress · #611MasterStudy LMS Word · #1776StepUp LMS · #64775

Rating trend

Star average over time · dips mark rough releases

4.431 Oct 2026

Health trend

Composite health score, snapshotted daily

7931 Oct 2026

Update activity

How busy the existing users are, measured as downloads in the last 30 days for every 1,000 active sites. A spike means a new release everyone's pulling; a long, slow decline means an aging user base that updates less.

1.5K31 Oct 2026

Release cadence

Actively maintained
from wp.org release tags

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

29

releases in the last 12 months

4d ago

latest release · v4.2.0 · 27 Oct 2026

197

tagged releases on record

Recent releases

4.2.0 · 27 Oct 20264.1.3 · 27 Oct 20264.1.2 · 12 Oct 20264.1.1 · 6 Oct 20264.1.0 · 29 Sep 20264.0.9 · 17 Sep 20264.0.8 · 10 Sep 20264.0.7 · 21 Aug 20264.0.6 · 18 Aug 20264.0.5 · 12 Aug 20264.0.4 · 31 Jul 20264.0.3 · 24 Jul 20264.0.2 · 22 Jul 20264.0.1 · 10 Jul 2026

What its installed base runs

via wordpress.org

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

v3.9 48%
v4.0 26%
Older / other versions 26%

Estimated active installs

The public count shows “100K+”. Our estimate pins where the real number sits.

tracked estimate
100K–200K ≈190K

Crossed into this band 21 months ago; a band this size takes about a year or more to cross, which places it about 90% of the way through.

Install history since 1 Nov 2021

100K31 Oct 2026

Recent reviews

All reviews on wp.org ↗
  1. ★★★★★ guezs
    3mo ago

    Ha cambiado todo. Los menús están en inglés. Las personalizaciones no funcionan. Los usuarios están desconcertados y perdidos.

    Read on wp.org ↗
  2. ★★★★★ lazarmld
    4mo ago

    It’s great plugin and all, but this auto-update to 4.0 version and breaking everyones sites is a bold move. And then closing option to open a ticket for a free plugin is even bolder. Well played Tutor.Edit: they have open the support threads, you get one star back This topic was modified 1 week, 2 days ago by lazarmld.

    Read on wp.org ↗
  3. ★★★★★ susanbastin
    6mo ago

    Support team is very helpful, especially Mr. Rashed helped me a lot.

    Read on wp.org ↗
  4. ★★★★★ lashram
    7mo ago

    Having issues with TutorLMS on my site and the 24/7 support isn’t live, I wanted to work through my issues in real time and their only offer was for me to provide access to my admin. Absolutely not! I don’t trust anyone with admin access unsupervised! Luckily it’s opensource and I have some skills …

    Read on wp.org ↗
  5. ★★★★★ karanu123
    9mo ago

    I bought the Tutor Pro app, but had challenges installing the theme. I applaud the support team for guiding me through the entire onboarding process and forsetting up the app and theme on my site. All I have to do is create my courses and edit the theme to my liking. Thank you, the support team.

    Read on wp.org ↗
  6. ★★★★★ matteo raggi
    9mo ago

    I tested many lms, dozens and it looks to eb the best to my eyes.

    Read on wp.org ↗
  7. ★★★★★ altaira84
    9mo ago

    Sama darmowa wersja działała jako tako choć była bardzo toporna i ograniczona! Nie pozwalała nawet podejrzeć kursu w czasie jego tworzenia! To Żenujące! Prawdziwe problemy zaczęły się po instalacji PRO! Wszyscy klienci stracili historię zamówień kursów a tym samym dostęp do kursów za które zapłacili! Licencja nie działa a gwarantowana obsługa 24/7 ma w dup…e problemy klientów premium i nawet nie raczy udzielić pomocy w tym zakresie! Oczekiwanie na odpowiedź to od kilkunastu godzin do kilku dni! Człowiek zapłacił prawie tysiąc złotych i został sam z problemem! NIE POLECAM!

    Read on wp.org ↗
  8. ★★★★★ rosterdotcom
    10mo ago

    Posted many days ago about issues this plugin has and nothing. I’m not the only one. Others have posted with no responses. This plugin has potential but with the lack of support, well, it’s just useless. Do better!

    Read on wp.org ↗

Security history

via Wordfence Intelligence

1 open vulnerability affects the current version (4.2.0). 99 of 100 disclosed are patched.

  1. Patched Medium · 6.4 Tutor LMS – eLearning and online course solution <= 4.1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting ↗
    2026-10-17 CVE-2026-111407 Improper Neutralization of Input During Web Page Generation Affects <= 4.1.2 Patched in 4.1.3
  2. Patched Medium · 4.3 Tutor LMS <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover via 'ID' Parameter ↗
    2026-10-16 CVE-2026-92715 Authorization Bypass Through User-Controlled Key Affects <= 4.1.0 Patched in 4.1.1
  3. Patched Medium · 6.4 Tutor LMS <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name Parameter ↗
    2026-10-15 CVE-2026-93681 Improper Neutralization of Input During Web Page Generation Affects <= 4.1.0 Patched in 4.1.1
  4. Patched Medium · 6.1 Tutor LMS <= 4.0.8 - Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting via 'redirect_url' Parameter ↗
    2026-10-15 CVE-2026-88963 Improper Neutralization of Input During Web Page Generation Affects <= 4.0.8 Patched in 4.0.9
  5. Patched Medium · 4.7 Tutor LMS <= 4.1.0 - Reflected Cross-Site Scripting via 'tab' Parameter ↗
    2026-10-13 CVE-2026-100193 Improper Neutralization of Input During Web Page Generation Affects <= 4.1.0 Patched in 4.1.1
  6. Patched Medium · 5.3 Tutor LMS <= 4.1.0 - Missing Authorization ↗
    2026-10-13 CVE-2026-96537 Missing Authorization Affects <= 4.1.0 Patched in 4.1.1
  7. Patched Medium · 4.3 Tutor LMS 4.0.5 - 4.1.0 - Authenticated (Instructor+) Insecure Direct Object Reference ↗
    2026-10-08 CVE-2026-85571 Authorization Bypass Through User-Controlled Key Affects 4.0.5 - 4.1.0 Patched in 4.1.1
  8. Open Medium · 4.3 Tutor LMS – eLearning and online course solution <= 4.1.2 - Authenticated (Subscriber+) Race Condition ↗
    2026-10-08 CVE-2026-42698 Concurrent Execution using Shared Resource with Improper Synchronization Affects <= 4.1.2 No patch available
  9. Patched High · 7.2 Tutor LMS – eLearning and online course solution <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting ↗
    2026-10-06 CVE-2026-42702 Improper Neutralization of Input During Web Page Generation Affects <= 4.1.0 Patched in 4.1.1
  10. Patched Medium · 4.3 Tutor LMS <= 4.0.7 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via 'payload' Parameter ↗
    2026-09-21 CVE-2026-18439 Authorization Bypass Through User-Controlled Key Affects <= 4.0.7 Patched in 4.0.8
  11. Patched Medium · 6.1 Tutor LMS <= 4.0.8 - Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters ↗
    2026-09-18 CVE-2026-89081 Improper Neutralization of Input During Web Page Generation Affects <= 4.0.8 Patched in 4.0.9
  12. Patched Medium · 4.3 Tutor LMS <= 4.0.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id' Parameter ↗
    2026-09-18 CVE-2026-88944 Missing Authorization Affects <= 4.0.8 Patched in 4.0.9
  13. Patched Medium · 6.5 Tutor LMS <= 4.0.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameter ↗
    2026-09-18 CVE-2026-89333 Authorization Bypass Through User-Controlled Key Affects <= 4.0.8 Patched in 4.0.9
  14. Patched Medium · 4.3 Tutor LMS 2.7.1 - 4.0.7 - REST API Authentication Confusion ↗
    2026-09-14 CVE-2026-85569 Improper Authorization Affects <= 4.0.7 Patched in 4.0.8
  15. Patched Medium · 4.3 Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) Information Exposure ↗
    2026-09-14 CVE-2026-85572 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 4.0.7 Patched in 4.0.8
  16. Patched High · 8.8 Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution ↗
    2026-09-11 CVE-2026-78175 Deserialization of Untrusted Data Affects <= 4.0.7 Patched in 4.0.8
  17. Patched Medium · 6.5 Tutor LMS – eLearning and online course solution < 4.0.6 - Authenticated (Custom Role+) Arbitrary File Read ↗
    2026-08-28 CVE-2026-19093 Improper Limitation of a Pathname to a Restricted Directory Affects < 4.0.6 Patched in 4.0.6
  18. Patched Medium · 6.5 Tutor LMS <= 4.0.5 - Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters ↗
    2026-08-27 CVE-2026-16759 Improper Neutralization of Special Elements in Output Used by a Downstream Component Affects <= 4.0.5 Patched in 4.0.6
  19. Patched Critical · 9.8 Tutor LMS <= 4.0.5 - Unauthenticated Arbitrary Zero-Argument Function Invocation ↗
    2026-08-26 CVE-2026-19092 Improper Control of Generation of Code Affects <= 4.0.5 Patched in 4.0.6
  20. Patched High · 7.5 Tutor LMS – eLearning and online course solution < 4.0.6 - Unauthenticated SQL Injection ↗
    2026-08-24 CVE-2026-19094 Improper Neutralization of Special Elements used in an SQL Command Affects < 4.0.6 Patched in 4.0.6
  21. Patched Medium · 4.3 Tutor LMS <= 4.0.5 - Authenticated (Instructor+) Insecure Direct Object Reference ↗
    2026-08-20 CVE-2026-14187 Authorization Bypass Through User-Controlled Key Affects <= 4.0.5 Patched in 4.0.6
  22. Patched Medium · 4.3 Tutor LMS – eLearning and online course solution < 4.0.0 - Missing Authorization ↗
    2026-07-30 CVE-2026-14310 Missing Authorization Affects < 4.0.0 Patched in 4.0.0
  23. Patched Medium · 4.9 Tutor LMS <= 4.0.1 - Authenticated (Administrator+) SQL Injection via 'coupon_code' Parameter ↗
    2026-07-27 CVE-2026-15444 Improper Neutralization of Special Elements used in an SQL Command Affects <= 4.0.1 Patched in 4.0.2
  24. Patched Medium · 6.5 Tutor LMS <= 4.0.0 - Authenticated (Subscriber+) SQL Injection via Stored Quiz Answer Array ↗
    2026-07-15 CVE-2026-15022 Improper Neutralization of Special Elements used in an SQL Command Affects <= 4.0.0 Patched in 4.0.1
  25. Patched Medium · 4.3 Tutor LMS – eLearning and online course solution <= 3.9.13 - Unauthenticated Insecure Direct Object Reference ↗
    2026-07-06 CVE-2026-57694 Authorization Bypass Through User-Controlled Key Affects <= 3.9.13 Patched in 3.9.14
  26. Patched Medium · 4.3 Tutor LMS <= 3.9.13 - Authenticated (Subscriber+) Information Exposure ↗
    2026-07-02 CVE-2026-14306 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 3.9.13 Patched in 3.9.14
  27. Patched Medium · 6.4 Tutor LMS <= 3.9.13 - Authenticated (Author+) Stored Cross-Site Scripting via Lesson Attachment Title ↗
    2026-06-30 CVE-2026-13443 Improper Neutralization of Input During Web Page Generation Affects <= 3.9.13 Patched in 3.9.14
  28. Patched Medium · 4.3 Tutor LMS <= 3.9.12 - Authenticated (Subscriber+) Information Disclosure ↗
    2026-06-22 CVE-2026-12275 Improper Authentication Affects <= 3.9.12 Patched in 3.9.13
  29. Patched Medium · 4.3 Tutor LMS <= 3.9.12 - Missing Authorization to Authenticated (Subscriber+) Comment Creation ↗
    2026-06-22 CVE-2026-12273 Missing Authorization Affects <= 3.9.12 Patched in 3.9.13
  30. Patched Medium · 4.3 Tutor LMS <= 3.9.12 - Authenticated (Subscriber+) Insecure Direct Object Reference to Quiz Attemp Modification ↗
    2026-06-22 CVE-2026-12271 Authorization Bypass Through User-Controlled Key Affects <= 3.9.12 Patched in 3.9.13
  31. Patched Medium · 4.9 Tutor LMS <= 3.9.11 - Authenticated (Administrator+) SQL Injection via 'data' Parameter ↗
    2026-06-17 CVE-2026-10736 Improper Neutralization of Special Elements used in an SQL Command Affects <= 3.9.11 Patched in 3.9.12
  32. Patched Medium · 5.3 Tutor LMS <= 3.9.9 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Post Deletion via 'course' GET Parameter ↗
    2026-05-12 CVE-2026-6965 Authorization Bypass Through User-Controlled Key Affects <= 3.9.9 Patched in 3.9.10
  33. Patched Medium · 5.3 Tutor LMS – eLearning and online course solution <= 3.9.7 - Missing Authorization ↗
    2026-04-20 CVE-2026-40743 Missing Authorization Affects <= 3.9.7 Patched in 3.9.8
  34. Patched Medium · 6.5 Tutor LMS <= 3.9.8 - Authenticated (Admin+) SQL Injection via 'date' Parameter ↗
    2026-04-16 CVE-2026-6080 Improper Neutralization of Special Elements used in an SQL Command Affects <= 3.9.8 Patched in 3.9.9
  35. Patched Medium · 5.3 Tutor LMS <= 3.9.8 - Authenticated (Subscriber+) Arbitrary Course Content Manipulation via tutor_update_course_content_order ↗
    2026-04-16 CVE-2026-5502 Missing Authorization Affects <= 3.9.8 Patched in 3.9.9
  36. Patched Medium · 4.3 Tutor LMS <= 3.9.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Course Content Modification ↗
    2026-04-10 CVE-2026-3371 Authorization Bypass Through User-Controlled Key Affects <= 3.9.7 Patched in 3.9.8
  37. Patched Medium · 5.4 Tutor LMS <= 3.9.7 - Missing Authorization to Authenticated (Subscriber+) Unauthorized Private Course Enrollment ↗
    2026-04-10 CVE-2026-3358 Missing Authorization Affects <= 3.9.7 Patched in 3.9.8
  38. Patched High · 7.5 Tutor LMS <= 3.9.7 - Missing Authorization to Unauthenticated Arbitrary Billing Profile Overwrite via 'order_id' Parameter ↗
    2026-04-09 CVE-2026-3360 Missing Authorization Affects <= 3.9.7 Patched in 3.9.8
  39. Patched Medium · 4.3 Tutor LMS – eLearning and online course solution <= 3.9.4 - Authenticated (Subscriber+) Insecure Direct Object Reference ↗
    2026-03-16 CVE-2025-32223 Authorization Bypass Through User-Controlled Key Affects <= 3.9.4 Patched in 3.9.5
  40. Patched Medium · 4.3 Tutor LMS <= 3.9.7 - Missing Authorization ↗
    2026-03-15 CVE-2026-40740 Missing Authorization Affects <= 3.9.7 Patched in 3.9.8
  41. Patched High · 7.5 Tutor LMS <= 3.9.6 - Unauthenticated SQL Injection via coupon_code ↗
    2026-02-27 CVE-2025-13673 Improper Neutralization of Special Elements used in an SQL Command Affects <= 3.9.6 Patched in 3.9.7
  42. Patched Medium · 4.3 Tutor LMS – eLearning and online course solution <= 3.9.5 - Missing Authorization ↗
    2026-02-25 CVE-2026-23799 Missing Authorization Affects <= 3.9.5 Patched in 3.9.6
  43. Patched Medium · 5.3 Tutor LMS <= 3.9.5 - Authenticated (Subscriber+) Information Disclosure in Coupon Details via 'tutor_coupon_details' AJAX Action ↗
    2026-02-02 CVE-2026-1371 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 3.9.5 Patched in 3.9.6
  44. Patched High · 8.1 Tutor LMS <= 3.9.5 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Course Modification and Deletion ↗
    2026-02-02 CVE-2026-1375 Authorization Bypass Through User-Controlled Key Affects <= 3.9.5 Patched in 3.9.6
  45. Patched Medium · 5.4 Tutor LMS – eLearning and online course solution <= 3.9.4 - Missing Authorization to Authenticated (Subscriber+) Limited Attachment Deletion ↗
    2026-01-20 CVE-2026-0548 Missing Authorization Affects <= 3.9.4 Patched in 3.9.5
  46. Patched Medium · 4.3 Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Coupon Modification ↗
    2026-01-08 CVE-2025-13628 Missing Authorization Affects <= 3.9.3 Patched in 3.9.4
  47. Patched Medium · 4.3 Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Course Completion ↗
    2026-01-08 CVE-2025-13935 Missing Authorization Affects <= 3.9.2 Patched in 3.9.4
  48. Patched Medium · 4.3 Tutor LMS – eLearning and online course solution <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Course Enrollment Bypass ↗
    2026-01-08 CVE-2025-13934 Missing Authorization Affects <= 3.9.3 Patched in 3.9.4
  49. Patched Medium · 6.5 Tutor LMS <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via tutor_order_details ↗
    2026-01-07 CVE-2025-13679 Missing Authorization Affects <= 3.9.3 Patched in 3.9.4
  50. Patched Medium · 4.3 Tutor LMS <= 3.9.4 - Authenticated (Instructor+) Insecure Direct Object Reference ↗
    2026-01-02 CVE-2025-47555 Authorization Bypass Through User-Controlled Key Affects <= 3.9.4 Patched in 3.9.5
  51. Patched Medium · 4.3 Tutor LMS <= 3.8.3 - Missing Authorization to Sensitive Information Exposure ↗
    2025-10-24 CVE-2025-6680 Improper Access Control Affects <= 3.8.3 Patched in 3.9.0
  52. Patched Medium · 5.3 Tutor LMS – eLearning and online course solution <= 3.8.3 - Missing Authorization to Unauthenticated Payment Status Update ↗
    2025-10-24 CVE-2025-11564 Missing Authorization Affects <= 3.8.3 Patched in 3.9.0
  53. Patched Medium · 4.9 Tutor LMS <= 3.7.4 - Authenticated (Administrator+) SQL Injection ↗
    2025-09-09 CVE-2025-58993 Improper Neutralization of Special Elements used in an SQL Command Affects <= 3.7.4 Patched in 3.8.0
  54. Patched Medium · 4.3 Tutor LMS <= 3.4.0 - Authenticated (Subscriber+) HTML Injection ↗
    2025-04-07 CVE-2025-32230 Improper Input Validation Affects <= 3.4.0 Patched in 3.4.1
  55. Patched High · 7.5 Tutor LMS <= 2.7.6 - Unauthenticated SQL Injection via rating_filter ↗
    2024-11-20 CVE-2024-10400 Improper Neutralization of Special Elements used in an SQL Command Affects <= 2.7.6 Patched in 2.7.7
  56. Patched Medium · 5.3 Tutor LMS <= 2.7.6 - User Registration Setting Bypass to Unauthorized User Registration ↗
    2024-11-20 CVE-2024-10393 Improper Access Control Affects <= 2.7.6 Patched in 2.7.7
  57. Patched Medium · 4.3 Tutor LMS <= 2.7.4 - Cross-Site Request Forgery via 'addon_enable_disable' ↗
    2024-09-09 CVE-2023-2919 Cross-Site Request Forgery Affects <= 2.7.4 Patched in 2.7.5
  58. Patched High · 7.2 Tutor LMS <= 2.7.2 - Authenticated (Administrator+) SQL Injection ↗
    2024-08-16 CVE-2024-43282 Improper Neutralization of Special Elements used in an SQL Command Affects <= 2.7.2 Patched in 2.7.3
  59. Patched Medium · 5.5 Tutor LMS <= 2.7.3 - Authenticated (Instructor+) Stored Cross-Site Scripting ↗
    2024-08-09 CVE-2024-43231 Improper Neutralization of Input During Web Page Generation Affects <= 2.7.3 Patched in 2.7.4
  60. Patched Medium · 5.3 Tutor LMS <= 2.7.3 - Missing Authorization ↗
    2024-08-07 CVE-2024-43142 Missing Authorization Affects <= 2.7.3 Patched in 2.7.4
  61. Patched Medium · 4.3 Tutor LMS <= 2.7.2 - Cross-Site Request Forgery ↗
    2024-08-01 CVE-2024-39645 Cross-Site Request Forgery Affects <= 2.7.2 Patched in 2.7.3
  62. Patched Medium · 5.5 Tutor LMS <= 2.7.2 - Authenticated (Tutor Instructor+) Stored Cross-Site Scripting ↗
    2024-07-10 CVE-2024-37947 Improper Neutralization of Input During Web Page Generation Affects <= 2.7.2 Patched in 2.7.3
  63. Patched Low · 2.7 Tutor LMS <= 2.7.1 - Authenticated (Admin+) Path Traversal ↗
    2024-06-27 CVE-2024-37266 Improper Limitation of a Pathname to a Restricted Directory Affects <= 2.7.1 Patched in 2.7.2
  64. Patched High · 7.2 Tutor LMS – eLearning and online course solution <= 2.7.1 -Authenticated (Administrator+) SQL Injection ↗
    2024-06-06 CVE-2024-4902 Improper Neutralization of Special Elements used in an SQL Command Affects <= 2.7.1 Patched in 2.7.2
  65. Patched Medium · 4.3 Tutor LMS – eLearning and online course solution <= 2.7.1 - Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Quiz Attempt Deletion ↗
    2024-06-06 CVE-2024-5438 Authorization Bypass Through User-Controlled Key Affects <= 2.7.1 Patched in 2.7.2
  66. Patched Medium · 6.5 Tutor LMS – eLearning and online course solution <= 2.7.0 - Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Course Deletion ↗
    2024-05-15 CVE-2024-4279 Authorization Bypass Through User-Controlled Key Affects <= 2.7.0 Patched in 2.7.1
  67. Patched High · 8.8 Tutor LMS <= 2.7.0 - Authenticated (Instructor+) SQL Injection ↗
    2024-05-15 CVE-2024-4318 Improper Neutralization of Special Elements used in an SQL Command Affects <= 2.7.0 Patched in 2.7.1
  68. Patched Critical · 9.8 Tutor LMS <= 2.7.0 - Missing Authorization ↗
    2024-05-15 CVE-2024-4223 Missing Authorization Affects <= 2.7.0 Patched in 2.7.1
  69. Patched Medium · 6.5 Tutor LMS <= 2.6.2 - Missing Authorization to Unauthenticated Limited Options Update ↗
    2024-04-26 CVE-2024-3553 Missing Authorization Affects <= 2.6.2 Patched in 2.7.0
  70. Patched Medium · 5.4 Tutor LMS – eLearning and online course solution <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tutor_instructor_list' Shortcode ↗
    2024-04-24 CVE-2024-3994 Improper Neutralization of Input During Web Page Generation Affects <= 2.6.2 Patched in 2.7.0
  71. Patched Medium · 4.3 Tutor LMS – eLearning and online course solution <= 2.6.1 - Cross-Site Request Forgery to Plugin Deactivation and Data Erase ↗
    2024-03-12 CVE-2024-1503 Cross-Site Request Forgery Affects <= 2.6.1 Patched in 2.6.2
  72. Patched Medium · 5.4 Tutor LMS – eLearning and online course solution <= 2.6.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion ↗
    2024-03-12 CVE-2024-1502 Missing Authorization Affects <= 2.6.1 Patched in 2.6.2
  73. Patched High · 8.8 Tutor LMS – eLearning and online course solution <= 2.6.1 - Authenticated (Subscriber+) SQL Injection ↗
    2024-03-11 CVE-2024-1751 Improper Neutralization of Special Elements used in an SQL Command Affects <= 2.6.1 Patched in 2.6.2
  74. Patched Medium · 5.4 Tutor LMS <= 2.6.0 - Authenticated(Student+) HTML Injection via Q&A ↗
    2024-02-20 CVE-2024-1128 Improper Neutralization of Special Elements in Output Used by a Downstream Component Affects <= 2.6.0 Patched in 2.6.1
  75. Patched Medium · 4.3 Tutor LMS <= 2.6.0 - Missing Authorization ↗
    2024-02-20 CVE-2024-1133 Missing Authorization Affects <= 2.6.0 Patched in 2.6.1
  76. Patched Medium · 4.4 Tutor LMS <= 2.2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
    2023-12-05 CVE-2023-49829 Improper Neutralization of Input During Web Page Generation Affects <= 2.2.4 Patched in 2.3.0
  77. Patched Medium · 6.4 Tutor LMS <= 2.2.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting ↗
    2023-09-25 CVE-2023-4805 Improper Neutralization of Input During Web Page Generation Affects <= 2.2.4 Patched in 2.3.0
  78. Patched High · 7.5 Tutor LMS <= 2.2.0 - Missing Authorization via REST API ↗
    2023-06-12 CVE-2023-3133 Missing Authorization Affects <= 2.2.0 Patched in 2.2.1
  79. Patched High · 8.8 Tutor LMS <= 2.2.0 - Authenticated (Student+) SQL Injection ↗
    2023-05-30 CVE-2023-25800 Improper Neutralization of Special Elements used in an SQL Command Affects <= 2.2.0 Patched in 2.2.1
  80. Patched High · 8.8 Tutor LMS <= 2.1.10 - Authenticated (Tutor Instructor+) SQL Injection ↗
    2023-05-30 CVE-2023-25990 Improper Neutralization of Special Elements used in an SQL Command Affects <= 2.1.10 Patched in 2.2.0
  81. Patched Critical · 9.8 Tutor LMS <= 2.1.10 - Unauthenticated SQL Injection ↗
    2023-05-30 CVE-2023-25700 Improper Neutralization of Special Elements used in an SQL Command Affects <= 2.1.10 Patched in 2.2.0
  82. Patched Medium · 5.4 Tutor LMS <= 2.1.8 - Missing Authorization via multiple AJAX actions ↗
    2023-05-24 CVE-2023-25799 Missing Authorization Affects <= 2.1.8 Patched in 2.1.9
  83. Patched Medium · 6.1 Tutor LMS <= 2.0.9 - Reflected Cross-Site Scripting ↗
    2023-01-12 CVE-2023-0236 Improper Neutralization of Input During Web Page Generation Affects <= 2.0.9 Patched in 2.0.10
  84. Patched Medium · 5.5 Tutor LMS <= 2.0.9 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
    2022-09-26 CVE-2022-2563 Improper Neutralization of Input During Web Page Generation Affects <= 2.0.9 Patched in 2.0.10
  85. Patched Medium · 6.1 Tutor LMS – eLearning and online course solution 2.0.0-2.0.8 - Reflected Cross-Site Scripting ↗
    2022-08-22 Improper Neutralization of Input During Web Page Generation Affects 2.0.0 - 2.0.8 Patched in 2.0.9
  86. Patched High · 7.2 Tutor LMS <= 1.9.11 - Stored Cross-Site Scripting ↗
    2021-12-27 Improper Neutralization of Input During Web Page Generation Affects <= 1.9.11 Patched in 1.9.12
  87. Patched Medium · 6.1 Tutor LMS <= 1.9.11 - Reflected Cross-Site Scripting ↗
    2021-12-27 CVE-2021-25017 Improper Neutralization of Input During Web Page Generation Affects <= 1.9.11 Patched in 1.9.12
  88. Patched Medium · 6.1 Tutor LMS <= 1.9.10 - Reflected Cross-Site Scripting ↗
    2021-10-19 CVE-2021-24873 Improper Neutralization of Input During Web Page Generation Affects <= 1.9.10 Patched in 1.9.11
  89. Patched Medium · 5.5 Tutor LMS <= 1.9.8 - Admin+ Stored Cross-Site Scripting ↗
    2021-09-20 CVE-2021-24740 Improper Neutralization of Input During Web Page Generation Affects < 1.9.9 Patched in 1.9.9
  90. Patched Medium · 6.1 Tutor LMS <= 1.9.5 - Cross-Site Scripting ↗
    2021-08-09 Improper Neutralization of Input During Web Page Generation Affects <= 1.9.5 Patched in 1.9.6
  91. Patched Medium · 5.5 Tutor LMS <= 1.9.1 - Authenticated Stored Cross-Site Scripting ↗
    2021-06-28 CVE-2021-24455 Improper Neutralization of Input During Web Page Generation Affects <= 1.9.1 Patched in 1.9.2
  92. Patched Medium · 5.5 Tutor LMS <= 1.8.7 - Authenticated Local File Inclusion ↗
    2021-04-05 CVE-2021-24242 Improper Control of Filename for Include/Require Statement in PHP Program Affects <= 1.8.7 Patched in 1.8.8
  93. Patched High · 8.8 Tutor LMS – eLearning and online course solution <= 1.7.6 - Unprotected AJAX including Privilege Escalation ↗
    2021-03-15 CVE-2021-24184 Improper Privilege Management Affects < 1.7.7 Patched in 1.7.7
  94. Patched Medium · 6.5 Tutor LMS <= 1.8.2 - SQL Injection via tutor_quiz_builder_get_question_form ↗
    2021-03-15 CVE-2021-24183 Improper Neutralization of Special Elements used in an SQL Command Affects <= 1.8.2 Patched in 1.8.3
  95. Patched Medium · 6.5 Tutor LMS – eLearning and online course solution <=1.7.6 - SQL Injection ↗
    2021-03-15 CVE-2021-24185 Improper Neutralization of Special Elements used in an SQL Command Affects < 1.7.7 Patched in 1.7.7
  96. Patched Medium · 6.5 Tutor LMS – eLearning and online course solution <= 1.7.6 - SQL Injection ↗
    2021-03-15 CVE-2021-24181 Improper Neutralization of Special Elements used in an SQL Command Affects < 1.7.7 Patched in 1.7.7
  97. Patched High · 8.8 Tutor LMS <=1.8.2 - SQL Injection via tutor_quiz_builder_get_answers_by_question ↗
    2021-03-15 CVE-2021-24182 Improper Neutralization of Special Elements used in an SQL Command Affects <= 1.8.2 Patched in 1.8.3
  98. Patched High · 8.8 Tutor LMS <=1.8.2 - SQL Injection via tutor_answering_quiz_question/get_answer_by_id ↗
    2021-03-15 CVE-2021-24186 Improper Neutralization of Special Elements used in an SQL Command Affects < 1.8.3 Patched in 1.8.3
  99. Patched Medium · 6.1 Tutor LMS <= 1.9.12 - Reflected Cross-Site Scripting ↗
    2021-01-10 Improper Neutralization of Input During Web Page Generation Affects <= 1.9.12 Patched in 1.9.13
  100. Patched High · 8.8 Tutor LMS < 1.5.3 - Cross-Site Request Forgery ↗
    2020-02-04 CVE-2020-8615 Cross-Site Request Forgery Affects < 1.5.3 Patched in 1.5.3

Vulnerability records provided by Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. License and terms.

CVE records: Copyright 1999-2026 The MITRE Corporation. CVE terms of use.

Behavioral tests

via WP Hive

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0.1

✓ Low memory footprint
✕ Low page-speed impact
✓ Runs on latest PHP + WP
✓ No PHP errors
✓ No JS errors
✓ Activates cleanly
✓ No resource errors
✕ No external HTTP errors
✓ Optimized database use
✓ Frequently updated

Languages

via translate.wordpress.org

Translated into 47 languages, 8 at 90% or more

Galician 100%
Serbian 100%
Chinese (Taiwan) 97%
Dutch 97%
Dutch (Formal) 97%
Spanish (Chile) 97%
Spanish (Spain) 97%
Finnish 96%
German (Formal) 81%
German 78%
Russian 78%
Persian 73%
Korean 72%
Lao 72%
Arabic 65%
Bengali 62%
Romanian 54%
Swedish 52%
French (France) 44%
Turkish 44%
Vietnamese 44%
Czech 43%
Polish 42%
Ukrainian 37%

Plus 23 more locales with partial translations.

AI assistants

How it's measured →

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Premium

Share of voice

How often each assistant names Tutor LMS when asked about these topics, where it comes in the answer, and how that compares with its wp.org search position. Latest run 25 Oct 2026.

Assistants
ChatGPT, Claude
Topics tracked
Ecommerce, Membership, Multilingual
Get early access to Premium →

Readme readiness

8 of 8 pass · checked 25 Oct 2026

Can an assistant quote this readme? Eight deterministic checks over the wp.org listing, no model involved.

  • ✓ Says what it does "A complete WordPress LMS plugin to create any eLearning website easily."
  • ✓ Has a FAQ 5 questions in the FAQ.
  • ✓ FAQ asks real questions 5 of 5 read like questions a user would type.
  • ✓ Names who it is for Names its audience or use cases ("who wants", "designed for").
  • ✓ Names what it works with Mentions WooCommerce, Elementor, Divi, Oxygen and 13 more.
  • ✓ Headings and lists 35 headings and 2 lists.
  • ✓ Enough to quote 15,772 characters of description.
  • ✓ Tags match the text All 5 tags appear in the text.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

  1. 2025-02-08 90K+ → 100K+ up after 230 days in tier
  2. 2024-06-23 80K+ → 90K+ up after 1 days in tier
  3. 2024-06-22 90K+ → 80K+ down after 2 days in tier
  4. 2024-06-20 80K+ → 90K+ up after 197 days in tier
  5. 2023-12-06 70K+ → 80K+ up after 238 days in tier
  6. 2023-04-12 60K+ → 70K+ up after 176 days in tier
  7. 2022-10-18 50K+ → 60K+ up after 200 days in tier
  8. 2022-04-01 40K+ → 50K+ up after 182 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for Tutor LMS – eLearning and online course solution into a readme, a review or a deck. It updates itself.

<iframe src="https://plugins.wpmayor.com/embed/tutor" width="480" height="300" style="border:0" loading="lazy" title="Tutor LMS – eLearning and online course solution — Plugin Pulse"></iframe>
Preview card ↗

Tutor LMS – eLearning and online course solution: 100K+ active installs, 4.4★ (590 reviews). Plugin Pulse (WP Mayor), as of 2026-10-31. https://plugins.wpmayor.com/plugin/tutor

Spotted a number that looks wrong? Report a data issue and we'll check it against the source.