CVE-2025-63035

MediumCVSS 6.5

Published: 09/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

9th percentile - higher than 9% of all known CVEs

Summary

DOM-Based XSS vulnerability in WPLMS plugin by VibeThemes. Improper input neutralization during web page generation allows client-side script injection.

Risk Assessment

An attacker can execute malicious scripts in the user's browser, potentially leading to data theft, session hijacking, or content modification.

Recommendation

Update WPLMS plugin to a version newer than 1.9.9.5.4, which includes a fix for this vulnerability.

Other vulnerabilities in WPLMS

See all

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VibeThemes WPLMS wplms_plugin allows DOM-Based XSS.This issue affects WPLMS: from n/a through <= 1.9.9.5.4.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS