The vulnerability allows an attacker to inject malicious script into web pages rendered by the Sikshya LMS WordPress plugin. Because user input is not properly sanitized before being included in the page, an attacker can send a crafted URL that causes arbitrary JavaScript to execute in the victim’s browser. The primary impact is the potential theft of session cookies, credential compromise, or malicious actions performed on behalf of the user.

WordPress installations using the MantraBrain Sikshya LMS plugin, versions from the first release up to and including 0.0.21, are affected.

The CVSS base score of 7.1 indicates a high severity vulnerability. The EPSS score of less than 1% suggests that exploitation is currently rare, and the vulnerability is not listed in CISA’s KEV catalog. Attacks would likely involve an attacker crafting a malicious URL that a user clicks or is otherwise induced to visit, resulting in reflected XSS execution. No specialized prerequisites beyond the presence of the vulnerable plugin are required.