SecvalisbySYSDEVOPS.EU
CVE Catalog
EnglishPolski

CVE-2025-53420

HighCVSS 7.1
Published: Updated: Translated: NVD NIST

Exploitation Probability (EPSS)

Low risk
0.25%

15th percentile - higher than 15% of all known CVEs

Summary

Reflected XSS vulnerability in VibeThemes WPLMS plugin (wplms_plugin) up to version 1.9.9.8 due to improper input neutralization during web page generation.

Risk Assessment

An attacker can inject malicious script into the victim's browser, potentially leading to session theft, account takeover, or other attacks.

Recommendation

Upgrade WPLMS to a version newer than 1.9.9.8 if available. Additionally, sanitize input and output.

Other vulnerabilities in WPLMS

See all
Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VibeThemes WPLMS wplms_plugin allows Reflected XSS.This issue affects WPLMS: from n/a through <= 1.9.9.8.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS