CVE-2026-78532
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
Unauthenticated Cross Site Scripting (XSS) in LMS <= 8.3 versions.
Risk Assessment
An unauthenticated attacker can execute arbitrary JavaScript in the victim's browser, potentially leading to session theft, redirects, or page content modification.
Recommendation
Update the LMS plugin to a version later than 8.3 and, if needed, implement additional input filtering and security headers.
Other vulnerabilities in LMS
See all- CVE-2023-1728Critical
The vulnerability in Fernus Informatics LMS allows unrestricted upload of files with dangerous types, potentially leading to OS Command Injection and Server Side Include (SSI) Injection.
- CVE-2026-27404High
An unauthenticated Cross Site Scripting (XSS) vulnerability exists in LMS version 9.7 and earlier. It allows a remote attacker to inject malicious scripts without authentication.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in LMS <= 8.3 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS