Description
Unauthenticated Cross Site Scripting (XSS) in LMS <= 8.3 versions.
Published: 2026-10-10
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Cross Site Scripting (XSS)
Action: Asses Impact
AI Analysis

Impact

An unauthenticated Cross Site Scripting flaw exists in WordPress LMS themes version 8.3 and earlier, allowing attackers to inject client‑side scripts into web pages that visitors load. The vulnerability is identified by CWE-79.

Affected Systems

The issue affects the DesignThemes LMS WordPress theme in all releases up to and including version 8.3. Site owners using any of these versions of the theme are vulnerable.

Risk and Exploitability

With a CVSS score of 7.1, the vulnerability presents a substantial risk to users who access an affected site. The EPSS score is not available, so the likelihood of exploitation is unknown, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is unauthenticated input entered through any field or URL that the theme processes without proper sanitization. An attacker can trigger the XSS without requiring authentication or elevated privileges.

Generated by OpenCVE AI on October 10, 2026 at 21:47 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the LMS theme to a version newer than 8.3 that contains the XSS fix.
  • If an upgrade is not immediately possible, limit exposure by disabling or removing the parts of the theme that accept user input or content rendering.
  • Apply a Web Application Firewall with XSS protection enabled to monitor and block malicious script payloads before they reach end‑users.

Generated by OpenCVE AI on October 10, 2026 at 21:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 11 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 10 Oct 2026 19:45:00 +0000

Type Values Removed Values Added
Description Unauthenticated Cross Site Scripting (XSS) in LMS <= 8.3 versions.
Title WordPress LMS theme <= 8.3 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-10-11T11:42:57.727Z

Reserved: 2026-08-24T17:28:20.060Z

Link: CVE-2026-78532

cve-icon Vulnrichment

Updated: 2026-10-11T11:39:53.299Z

cve-icon NVD

Status : Deferred

Published: 2026-10-10T20:16:46.950

Modified: 2026-10-13T13:29:12.567

Link: CVE-2026-78532

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-10T22:00:13Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')