CVE Catalog
CVE-2026-39722
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk0.24%
13th percentile - higher than 13% of all known CVEs
Summary
Unauthenticated Cross Site Scripting (XSS) in WPLMS versions up to 4.972.
Risk Assessment
An attacker can inject malicious script, potentially leading to data theft or session hijacking.
Recommendation
Update the WPLMS plugin to the latest version that includes the security fix.
Other vulnerabilities in WPLMS
See all- CVE-2025-63035Medium
DOM-Based XSS vulnerability in WPLMS plugin by VibeThemes. Improper input neutralization during web page generation allows client-side script injection.
- CVE-2025-53420High
Reflected XSS vulnerability in VibeThemes WPLMS plugin (wplms_plugin) up to version 1.9.9.8 due to improper input neutralization during web page generation.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in WPLMS <= 4.972 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS