Wplms
Monthly
Blind SQL injection in the VibeThemes WPLMS WordPress e-learning theme, affecting all releases through version 4.973, lets an attacker with a logged-in low-privilege account inject SQL into backend queries and extract database contents through inference-based techniques. The authentication requirement (PR:L in the CVSS vector) is the main limiting factor, but it is a weak barrier in practice because many WPLMS-based learning sites allow open student or subscriber self-registration, effectively lowering the entry cost to near-anonymous. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing); independent assessment classifies it as a genuine, elevated-priority problem rather than an emergency, with high confidentiality impact (C:H), limited integrity exposure (I:L), and no confirmed availability impact (A:N).
Blind SQL injection in the VibeThemes WPLMS WordPress learning-management plugin affects every release prior to 1.9.9.8.2, letting an attacker who can reach the vulnerable endpoint infer and extract database contents - including WordPress user records and other sensitive tables - through a network-reachable, low-complexity attack (CWE-89, reported CVSS base 9.3). Exploitation status: no public exploit identified at time of analysis, and no CISA KEV listing. Sources disagree on prerequisites - the reported vector carries PR:N/S:C/C:H/I:N/A:L (unauthenticated, changed scope) while our independent assessment scores CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (low-privilege authenticated, unchanged scope), so the minimum privilege level required should be verified against the Patchstack advisory before treating the issue as anonymously exploitable.
Reflected cross-site scripting in the VibeThemes WPLMS WordPress theme (versions 4.972 and earlier) lets a remote, unauthenticated attacker inject script that executes in a victim's browser session when the victim follows a crafted link to a WPLMS-powered site. Exploitation is not autonomous: it depends on user interaction (CVSS vector UI:R), which tempers real-world exploitability, but the payload runs in the origin of the vulnerable site with a changed scope (S:C), so an authenticated administrator who clicks the link can have their privileged session targeted. There is no CISA KEV listing and no public exploit identified at time of analysis; the flaw was reported through Patchstack and carries a CVSS 3.1 base score of 7.1.
Blind SQL injection in the VibeThemes WPLMS WordPress e-learning theme, affecting all releases through version 4.973, lets an attacker with a logged-in low-privilege account inject SQL into backend queries and extract database contents through inference-based techniques. The authentication requirement (PR:L in the CVSS vector) is the main limiting factor, but it is a weak barrier in practice because many WPLMS-based learning sites allow open student or subscriber self-registration, effectively lowering the entry cost to near-anonymous. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing); independent assessment classifies it as a genuine, elevated-priority problem rather than an emergency, with high confidentiality impact (C:H), limited integrity exposure (I:L), and no confirmed availability impact (A:N).
Blind SQL injection in the VibeThemes WPLMS WordPress learning-management plugin affects every release prior to 1.9.9.8.2, letting an attacker who can reach the vulnerable endpoint infer and extract database contents - including WordPress user records and other sensitive tables - through a network-reachable, low-complexity attack (CWE-89, reported CVSS base 9.3). Exploitation status: no public exploit identified at time of analysis, and no CISA KEV listing. Sources disagree on prerequisites - the reported vector carries PR:N/S:C/C:H/I:N/A:L (unauthenticated, changed scope) while our independent assessment scores CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (low-privilege authenticated, unchanged scope), so the minimum privilege level required should be verified against the Patchstack advisory before treating the issue as anonymously exploitable.
Reflected cross-site scripting in the VibeThemes WPLMS WordPress theme (versions 4.972 and earlier) lets a remote, unauthenticated attacker inject script that executes in a victim's browser session when the victim follows a crafted link to a WPLMS-powered site. Exploitation is not autonomous: it depends on user interaction (CVSS vector UI:R), which tempers real-world exploitability, but the payload runs in the origin of the vulnerable site with a changed scope (S:C), so an authenticated administrator who clicks the link can have their privileged session targeted. There is no CISA KEV listing and no public exploit identified at time of analysis; the flaw was reported through Patchstack and carries a CVSS 3.1 base score of 7.1.