Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojoomla School Management allows Reflected XSS. This issue affects School Management: from n/a through 92.0.0.
Published: 2025-06-27
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw is an improper neutralization of input during web page generation in the School Management plugin, allowing reflected cross‑site scripting. Attackers can inject malicious scripts into data that is output back to the user’s browser without proper escaping, resulting in arbitrary script execution in the victim’s session.

Affected Systems

WordPress sites that use the mojoomla School Management plugin version 92.0.0 or older are affected. Versions newer than 92.0.0 have fixed the flaw.

Risk and Exploitability

The vulnerability carries a CVSS score of 7.1, indicating high severity, but its EPSS score is below 1 %, suggesting a low likelihood of exploitation at present. The issue is not listed in CISA KEV. An attacker can exploit the flaw by supplying malicious input that is reflected in a generated page, causing the embedded script to run in the victim’s browser.

Generated by OpenCVE AI on April 30, 2026 at 17:19 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the School Management plugin to a version newer than 92.0.0.
  • Ensure that the plugin encodes or sanitizes all user‑supplied data before rendering it in the browser to comply with CWE‑79 guidelines.
  • Deploy a web application firewall that filters or blocks requests containing suspicious script characters until a patch can be applied.

Generated by OpenCVE AI on April 30, 2026 at 17:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-19283 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojoomla School Management allows Reflected XSS. This issue affects School Management: from n/a through 92.0.0.
History

Tue, 28 Apr 2026 19:45:00 +0000

Type Values Removed Values Added
References

Tue, 28 Apr 2026 18:30:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojoomla School Management school-management allows Reflected XSS.This issue affects School Management: from n/a through <= 92.0.0. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojoomla School Management allows Reflected XSS. This issue affects School Management: from n/a through 92.0.0.
References

Thu, 23 Apr 2026 15:45:00 +0000

Type Values Removed Values Added
References

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojoomla School Management allows Reflected XSS. This issue affects School Management: from n/a through 92.0.0. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojoomla School Management school-management allows Reflected XSS.This issue affects School Management: from n/a through <= 92.0.0.
References

Fri, 27 Jun 2025 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 27 Jun 2025 12:00:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojoomla School Management allows Reflected XSS. This issue affects School Management: from n/a through 92.0.0.
Title WordPress School Management System Plugin <= 92.0.0 - Reflected Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T16:12:45.825Z

Reserved: 2025-05-07T09:55:20.908Z

Link: CVE-2025-47574

cve-icon Vulnrichment

Updated: 2025-06-27T13:06:47.498Z

cve-icon NVD

Status : Deferred

Published: 2025-06-27T12:15:37.030

Modified: 2026-04-28T19:32:26.220

Link: CVE-2025-47574

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-30T17:30:26Z

Weaknesses