A stored cross‑site scripting vulnerability was discovered in Frappe Learning Management System. The flaw allows an attacker to inject malicious script that is permanently saved to the system and later executed in a victim’s browser when they view the affected content. This can lead to arbitrary script execution and credential theft or session hijacking. The weakness corresponds to CWE‑79, which describes unsanitized user input leading to script execution.

The vulnerability affects Frappe LMS versions from 2.27.0 up to but not including 2.48.0. All installations running those releases are susceptible, regardless of configuration, because the application does not properly sanitize inputs for stored content.

The CVSS base score of 6.9 places this issue in the medium to high impact range. The EPSS score is below 1%, indicating a low probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, reducing the likelihood of active exploitation. Exploitation requires user interaction, such as an authenticated content creator or user with sufficient privileges inserting malicious payloads, and the attack vector is likely through the LMS content management interface.