CVE-2025-24630
Published: 03 February 2025
Description
Adversaries may abuse various implementations of JavaScript for execution.
Security Summary
CVE-2025-24630 is an improper neutralization of input during web page generation vulnerability, enabling reflected cross-site scripting (XSS) as classified under CWE-79, in the MantraBrain Sikshya LMS WordPress plugin. This issue affects all versions of Sikshya LMS from n/a through 0.0.21 inclusive. The vulnerability carries a CVSS v3.1 base score of 7.1, with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, and was published on 2025-02-03T15:15:27.730.
Unauthenticated attackers accessible over the network can exploit this vulnerability with low attack complexity, though it requires user interaction, such as a victim clicking a malicious link. Exploitation changes the security scope and allows limited impacts on confidentiality, integrity, and availability, typically enabling arbitrary JavaScript execution in the victim's browser context.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/sikshya/vulnerability/wordpress-sikshya-lms-plugin-0-0-21-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The reflected XSS vulnerability is directly exploited via a malicious link requiring user interaction, enabling arbitrary JavaScript execution in the victim's browser context.