CVE-2025-63035
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
DOM-Based XSS vulnerability in WPLMS plugin by VibeThemes. Improper input neutralization during web page generation allows client-side script injection.
Risk Assessment
An attacker can execute malicious scripts in the user's browser, potentially leading to data theft, session hijacking, or content modification.
Recommendation
Update WPLMS plugin to a version newer than 1.9.9.5.4, which includes a fix for this vulnerability.
Other vulnerabilities in WPLMS
See all- CVE-2026-95607High
Blind SQL Injection vulnerability in the WPLMS plugin. Affects versions from n/a through 4.973.
- CVE-2026-96327Critical
The WPLMS plugin (versions before 1.9.9.8.2) contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This allows an attacker to perform a Blind SQL Injection attack.
- CVE-2026-39722High
Unauthenticated Cross Site Scripting (XSS) in WPLMS versions up to 4.972.
- CVE-2025-53420High
Reflected XSS vulnerability in VibeThemes WPLMS plugin (wplms_plugin) up to version 1.9.9.8 due to improper input neutralization during web page generation.
- CVE-2025-58668Medium
The WPLMS plugin for WordPress (versions up to and including 4.970) contains a Missing Authorization vulnerability allowing exploitation of incorrectly configured access control levels. An unauthorized user can perform operations reserved for higher roles.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VibeThemes WPLMS wplms_plugin allows DOM-Based XSS.This issue affects WPLMS: from n/a through <= 1.9.9.5.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS