Reflected XSS Vulnerability in Sikshya LMS Plugin for WordPress
CVE-2024-12127

6.1MEDIUM

Key Information:

Vendor: Wordpress
Status: Learning Management System, Elearning, Course Builder, WordPress Lms Plugin – Sikshya Lms
Vendor: CVE Published:; 17 December 2024

What is CVE-2024-12127?

CVE-2024-12127 is a critical reflected cross-site scripting (XSS) vulnerability affecting all versions of the Sikshya LMS plugin for WordPress up to and including 0.0.21. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts into web pages. If successful, an attacker can manipulate users into clicking on malicious links, leading to unauthorized access and data exposure. Website owners using the Sikshya LMS plugin should prioritize updating to the latest version to mitigate this security risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Learning Management System, eLearning, Course Builder, WordPress LMS Plugin – Sikshya LMS * <= 0.0.21

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...

https://wordpress.org/plugins/sikshya/#developers

https://plugins.trac.wordpress.org/changeset/3207940/

CVSS V3.1

Score:

6.1

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Changed

Timeline

Vulnerability published
Dec 17, 2024
Vulnerability Reserved
Dec 4, 2024

Credit

Dale Mavers

JSON

Wordpress