Frappe LMS CVE-2026-39375

Exploitation requires an authenticated account that holds a course-editing role (PR:L) with access to the Course Management module, where the attacker populates the course meta tag fields - specifically the values rendered into index.html as meta name/property title, image, description, keywords (and the og:/twitter: equivalents), plus the course title, description heading and 'Know More' link. These values were stored without HTML sanitization and emitted without escaping prior to 2.52.0. Exploitation is further gated by required victim interaction (UI:P): a second user must load the affected course page for the stored script to execute. Limiting factors: the privileged editor role, the need for a victim to view the page, and the fix in 2.52.0 which both strips HTML on storage and escapes on render.

This is a stored XSS (CWE-79) in Frappe LMS rated CVSS 4.0 5.1 (Medium) with vector AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N. The signals are internally consistent and point to a bounded, lower-tier risk rather than a critical priority. PR:L confirms the attacker must already be an authenticated user holding a course-editing role - this is not an anonymous internet-facing flaw - and UI:P confirms a victim must visit the affected course page for the payload to fire. The vulnerable-system confidentiality/availability are N and integrity is only L, with the meaningful impact falling on the subsequent system (SC:L/SI:L) i.e. the victim's browser session. No EPSS score was supplied, the vulnerability is NOT in CISA KEV, and no working exploit is referenced - only the vendor advisory and fix commits. The vuln.today decision label is 'this_month', not 'act_now' or 'emergency', aligning with a moderate-urgency, patch-on-normal-cycle posture. Net assessment: a genuine but privilege-gated, interaction-dependent stored XSS affecting a niche product - real enough to patch, but not a widespread or urgent exploitation threat.

An authenticated user who has been granted a course-editing role injects a malicious JavaScript payload into one of the meta tag fields (e.g. title, description, keywords, image) of a course in the Course Management module. The value is stored without HTML sanitization and later rendered unescaped into the page's <meta>/<title>/heading markup, so when another user - such as a learner or administrator - views that course page, the script executes in their browser session. No public working exploit is referenced, though the vendor advisory and fix commits describe the mechanism precisely.