CVE-2026-78532
HighCVSS 7.1Summary
Unauthenticated Cross Site Scripting (XSS) in LMS <= 8.3 versions.
Risk Assessment
An unauthenticated attacker can execute arbitrary JavaScript in the victim's browser, potentially leading to session theft, redirects, or page content modification.
Recommendation
Update the LMS plugin to a version later than 8.3 and, if needed, implement additional input filtering and security headers.
Other vulnerabilities in LMS
See all- CVE-2026-27404High
An unauthenticated Cross Site Scripting (XSS) vulnerability exists in LMS version 9.7 and earlier. It allows a remote attacker to inject malicious scripts without authentication.
- CVE-2023-1728Critical
The vulnerability in Fernus Informatics LMS allows unrestricted upload of files with dangerous types, potentially leading to OS Command Injection and Server Side Include (SSI) Injection.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in LMS <= 8.3 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS