CVE-2026-78532— WordPress LMS theme <= 8.3 - Cross Site Scripting (XSS) vulnerability
Quick assessment
Affected
designthemes LMS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
LMS（学习管理系统）8.3 及以下版本中存在未认证的跨站脚本漏洞（XSS）。
Possible ATT&CK Techniques 1 AI
T1059 · Command and Scripting InterpreterAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| designthemes | LMS | n/a≤ 8.3 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-78532
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WordPress LMS theme <= 8.3 - Cross Site Scripting (XSS) vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Unauthenticated Cross Site Scripting (XSS) in LMS <= 8.3 versions.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| designthemes | LMS | n/a ~ 8.3 | - |
|
II. Public POCs for CVE-2026-78532
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-78532
请登录查看更多情报信息。
News Coverage for CVE-2026-78532 (1)
IV. Related Vulnerabilities
Same product: LMS
-
CVE-2026-96777
Forma LMS Multi-User-Selector AJAX Endpoint getData getDataT -
CVE-2026-54343
Frappe LMS: Path Traversal in SCORM File Serving -
CVE-2026-39385
Frappe LMS enrollment bypass in paid courses via unrelated b -
CVE-2026-27404
WordPress LMS theme <= 9.7 - Reflected Cross Site Scripting -
CVE-2026-40457
Reflected XSS in LMS
Same vendor: designthemes
-
CVE-2026-94061
WordPress Whistle - Sports Club theme <= 4.2 - Reflected Cro -
CVE-2026-11355
DT LMS <= 1.1 - Missing Authorization to Unauthenticated Arb -
CVE-2026-27404
WordPress LMS theme <= 9.7 - Reflected Cross Site Scripting -
CVE-2026-27402
WordPress Kids Life | Children School WordPress theme <= 5.2 -
CVE-2025-69155
WordPress Fitness Zone WordPress Theme theme <= 5.7 - Cross
Same weakness: CWE-79
-
CVE-2026-107864
WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scriptin -
CVE-2026-107865
WordPress JetMenu plugin <= 3.0.5 - Cross Site Scripting (XS -
CVE-2026-107866
WordPress JetElements For Elementor plugin <= 2.9.2.3 - Cros -
CVE-2026-108168
WordPress Custom Query Blocks plugin <= 5.6.0 - Cross Site S -
CVE-2026-108815
idcCMS member_deal.php cross site scripting
V. Comments for CVE-2026-78532
No comments yet