In Totara Learning Management System version 19.1.5 and earlier, the in‑app messaging client accepts user‑supplied HTML without fully sanitizing it, enabling an attacker to embed malicious tags in a message. When recipients view the message, the code runs in their browser, leading to Cross‑Site Scripting, session hijacking, and possible client‑side command execution. The weakness is a classic XSS, classified as CWE‑79.

All installations of Totara LMS running version 19.1.5 or older, regardless of deployment environment, are affected, as the flaw resides in the core messaging module.

The CVSS score of 8.0 reflects high impact, while the EPSS score indicates a low exploitation probability (< 1 %). The vulnerability is not listed in CISA’s KEV catalogue. Based on the description, it is inferred that the attack requires an authenticated user with permission to post messages, as the attacker must embed malicious HTML in a message that is then distributed to all users. Once a recipient opens the message, the payload executes in their browser, enabling session hijack and client‑side command execution.