Reflected XSS Vulnerability in Sikshya LMS Plugin for WordPress
CVE-2024-12127

6.1MEDIUM

Key Information:

Vendor
Mantrabrain
Status
Learning Management System, Elearning, Course Builder, WordPress Lms Plugin – Sikshya Lms
Vendor
CVE Published:
17 December 2024

Summary

CVE-2024-12127 is a critical reflected cross-site scripting (XSS) vulnerability affecting all versions of the Sikshya LMS plugin for WordPress up to and including 0.0.21. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts into web pages. If successful, an attacker can manipulate users into clicking on malicious links, leading to unauthorized access and data exposure. Website owners using the Sikshya LMS plugin should prioritize updating to the latest version to mitigate this security risk.

Affected Version(s)

Learning Management System, eLearning, Course Builder, WordPress LMS Plugin – Sikshya LMS * <= 0.0.21

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://wordpress.org/plugins/sikshya/#developers
https://plugins.trac.wordpress.org/changeset/3207940/

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dale Mavers
.