An injected script can execute in the browsers of users viewing the affected content, enabling attackers to hijack sessions, deface pages, or load additional malicious resources. This weakness is classified as CWE‑79 and permits a broad range of client‑side attacks that compromise confidentiality, integrity, and the user experience.

The vulnerability exists in the Academy LMS plugin from Kodezen LLC for WordPress with versions up through 3.4.0. No other versions have been reported as affected, and the plugin’s versioning scheme indicates that fixes are expected in newer releases.

The CVSS score of 6.5 places the issue in the medium severity range, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Exploitation would require an attacker to inject malicious markup into fields that are stored and later rendered, and a victim must view that content for the script to run. No external authentication prerequisites are listed, but the lack of details means the full attack surface cannot be precisely defined.