The Institute Management plugin stores the text entered for the ‘Enquiry Form Title’ without proper sanitization or output escaping. This allows an authenticated Administrator to inject arbitrary JavaScript that will execute whenever a user visits the form page, potentially hijacking sessions, stealing credentials, or executing further malicious payloads. The flaw is a classic stored XSS, directly impacting the confidentiality and integrity of all site visitors who load the affected page.

WordPress installations that use the Institute Management – Learning Management System plugin from weblizar, version 5.5 or earlier, on a multisite network or where the unfiltered_html capability has been disabled. Only installations where the Enquiry Form Title setting is exposed to administrators are affected.

The CVSS score of 4.4 classifies the vulnerability as low severity, and no EPSS data is available, indicating no current evidence of exploitation. The flaw requires authenticated access at the Administrator level and is limited to installations with unfiltered_html disabled, which reduces the risk surface. The likely attack vector is through the WordPress admin interface where the Enquiry Form Title field is edited. Although the vulnerability is not listed in the CISA KEV catalog, any compromise of an administrator account could enable session theft or defacement for site users.