EUVD-2026-41329
GHSA-mmf8-rfrr-cx8x
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Unauthenticated network reflected XSS needing victim click (UI:R) with browser-context scope change (S:C); low confidentiality/integrity impact but no genuine availability effect, so A:N.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in LMS <= 9.7 versions.
AnalysisAI
Reflected Cross-Site Scripting in the designthemes LMS WordPress theme (versions 9.7 and earlier) allows unauthenticated remote attackers to inject arbitrary JavaScript that executes in a victim's browser when they open a crafted link. Reported by Patchstack, the flaw carries CVSS 7.1 with a scope change, reflecting cross-context impact; no public exploit is identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
The affected component is 'LMS', a commercial WordPress learning-management theme published by designthemes (CPE cpe:2.3:a:designthemes:lms:*:*:*:*:*:*:*:*), deployed as a theme layer on top of the WordPress PHP application stack. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-controllable request input is reflected into an HTML response without adequate output encoding or sanitization. Because this is reflected (non-persistent) XSS, the malicious payload is delivered per-request via a crafted URL/parameter rather than stored server-side, and the theme renders it back into the page unescaped.
RemediationAI
Upgrade the LMS theme to a release newer than 9.7 once the vendor/Patchstack advisory confirms a fixed version; the supplied data does not include an exact patched version number, so verify the current fixed release directly via the Patchstack advisory (https://patchstack.com/database/wordpress/theme/lms/vulnerability/wordpress-lms-theme-9-7-reflected-cross-site-scripting-xss-vulnerability) before scheduling. As a compensating control until patched, deploy a WAF or Patchstack's virtual patching to filter reflected XSS payloads on the vulnerable theme parameters, and add response-side hardening such as a restrictive Content-Security-Policy that disallows inline script execution - noting CSP may break theme features that rely on inline scripts and requires testing. Because exploitation depends on a victim following a crafted link, user-awareness guidance on unsolicited links reduces but does not eliminate risk.
lms version <= LMS_011123 contains a Local File Disclosure vulnerability in File reading functionality in LMS module tha
Path traversal in Frappe Learning Management System (LMS) versions 2.50.0 and below allows authenticated users with cour
OS command injection in LMS (LAN Management System) before commit 9fcb4de allows authenticated adjacent attackers to exe
Error-based SQL injection in LMS (LAN Management System) before commit 4cb30a7 allows authenticated attackers to extract
Payment validation bypass in Frappe LMS 2.51.0 and earlier lets an authenticated user enroll in paid courses for free by
Stored cross-site scripting (XSS) in Frappe Learning Management System versions 2.27.0 through 2.47.x allows unauthentic
Frappe Learning Management System versions prior to 2.46.0 allow authenticated students to modify their own quiz scores
An issue in Mirapolis LMS 4.6.XX allows authenticated users to exploit an Insecure Direct Object Reference (IDOR) vulner
Reflected XSS in LAN Management System (LMS) before commit 9c5651b allows network-positioned attackers to inject arbitra
Metadata injection in Frappe LMS prior to version 2.53.0 enables authenticated users to embed crafted content into user-
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today