This vulnerability arises from improper neutralization of user-supplied input in the VibeThemes WPLMS WordPress plugin. A DOM‑based Cross‑Site Scripting flaw allows an attacker to inject arbitrary JavaScript into a page that is rendered by the plugin. Because the code is executed in the context of the site, an attacker could hijack user sessions, steal credentials, deface content, or conduct further phishing attacks. The weakness falls under CWE‑79, reflecting a failure to escape or sanitize output.

All installations of the WPLMS plugin from the earliest available version through version 1.9.9.5.4 are affected. This includes WordPress sites that have not updated the plugin after its release. The plugin is distributed by VibeThemes and integrated into many learning management systems hosted on WordPress.

The CVSS base score of 6.5 indicates a moderate impact. The EPSS score of less than 1 % suggests that exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog, so no public exploits have been confirmed yet. Nevertheless, the flaw can be triggered by any visitor to a page containing the vulnerable code, making it exploitable through social engineering or malicious link. Administrators should treat this as a potential risk that can be mitigated by updating the plugin.