Frappe Learning Management System allows user‑generated content. The vulnerability arises in versions 2.44.0 and earlier where an attacker can craft an image filename containing malicious JavaScript that is stored and later rendered within course or job pages. The stored XSS flaw can execute arbitrary script in the context of any user who views the page, potentially leading to credential theft, session hijacking or defacement.

Vulnerable to Frappe LMS 2.44.0 and earlier, any deployment of the learning management system that permits image uploads for courses or job listings without proper filename sanitization. The attack can be triggered by legitimate administrators or users with upload permissions.

The CVSS score is 1.3, indicating low severity, and the EPSS score is under 1%, suggesting a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack requires uploading a malicious filename, which is typically restricted to users with upload privileges; the flaw is client‑side only and does not provide remote code execution on the server. Exploitation would require a user to view the affected pages, making it a relatively low‑risk asset but still worth addressing to prevent phishing and other XSS attacks.