EUVD-2026-24636
GHSA-4mj3-26h4-xjcm
Severity by source
AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The Institute Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Enquiry Form Title' setting in all versions up to, and including, 5.5. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
AnalysisAI
Stored Cross-Site Scripting in Institute Management plugin for WordPress up to version 5.5 allows authenticated administrators to inject arbitrary JavaScript via the 'Enquiry Form Title' setting, which executes when users access affected pages. The vulnerability is limited to multi-site WordPress installations or sites with unfiltered_html disabled. CVSS 4.4 reflects high privilege requirements (PR:H) and conditional scope (multi-site only), but the stored XSS nature and administrator access requirement make this a targeted insider threat rather than a broad attack surface.
Technical ContextAI
The Institute Management plugin (Weblizar) fails to properly sanitize and escape user input in the 'Enquiry Form Title' administrative setting before storing and rendering it in page output. This is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) vulnerability. The root cause is insufficient use of WordPress escaping functions (such as esc_attr() or esc_html()) when outputting the setting value. The vulnerability only manifests in specific WordPress configurations: multi-site installations where capabilities are distributed across sites, or installations where the unfiltered_html capability has been explicitly disabled (common on shared hosting and security-hardened environments). CPE cpe:2.3:a:weblizar:institute_management_-_learning_management_system identifies the affected plugin across all versions through 5.5.
RemediationAI
Patch to Institute Management plugin version 5.6 or later (vendor patch version not explicitly confirmed in provided data; verify latest release at WordPress plugin repository). The fix applies proper escaping/sanitization to the Enquiry Form Title setting in wl_im_settings.php. No workarounds are practical for multi-site or unfiltered_html-disabled environments short of disabling the plugin. Immediate mitigation: restrict Administrator role to trusted users only and review admin account activity logs for unauthorized setting changes. For single-site installations with unfiltered_html enabled (default), risk is eliminated by configuration but patching is still recommended for defense-in-depth. Update via WordPress admin dashboard Plugins > Updates or download from https://plugins.trac.wordpress.org/browser/institute-management/.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today