CVE-2025-63035: WPLMS WordPress Plugin XSS Vulnerability

CVE-2025-63035 Overview

CVE-2025-63035 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the VibeThemes WPLMS plugin for WordPress. The flaw stems from improper neutralization of input during web page generation [CWE-79]. It affects all WPLMS wplms_plugin versions up to and including 1.9.9.5.4.

WPLMS is a WordPress Learning Management System used by online education sites, corporate training portals, and course marketplaces. Successful exploitation allows attackers to execute arbitrary JavaScript in the context of a victim's browser session. This can lead to session theft, credential harvesting, or unauthorized actions on behalf of authenticated users.

Critical Impact
Authenticated attackers can inject client-side scripts that execute in other users' browsers, enabling session hijacking and content manipulation within LMS portals.

Affected Products

VibeThemes WPLMS wplms_plugin versions up to and including 1.9.9.5.4
WordPress sites running the WPLMS Learning Management System plugin
Any hosted WordPress environment where WPLMS is active and unpatched

Discovery Timeline

2025-12-09 - CVE-2025-63035 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-63035

Vulnerability Analysis

The vulnerability is a DOM-Based Cross-Site Scripting flaw within the WPLMS plugin. DOM-Based XSS occurs when client-side JavaScript writes attacker-controlled data into the Document Object Model without proper sanitization or encoding. Unlike reflected or stored XSS, the malicious payload is processed entirely by the browser and may never appear in the server response.

The WPLMS plugin handles user-influenced values on the client side and passes them into DOM sinks that interpret HTML or JavaScript. An attacker who can influence URL parameters, fragment identifiers, or other DOM-readable inputs can craft a payload that the plugin's JavaScript renders as executable code.

Exploitation requires user interaction and low-privilege authentication. The scope is changed, meaning the injected script can affect resources beyond the vulnerable component's security context, such as authenticated admin sessions or other course participants.

Root Cause

The root cause is missing output encoding in client-side JavaScript executed by the WPLMS plugin. Attacker-controlled data reaches DOM sinks such as innerHTML, document.write, or eval-adjacent constructs without being escaped or validated. Refer to the Patchstack XSS Vulnerability Report for advisory details.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker crafts a malicious URL containing a JavaScript payload in a parameter the plugin reads on the client side. The victim, typically an authenticated LMS user, clicks the link and the plugin's JavaScript writes the payload into the DOM. The browser then executes the injected script within the site's origin.

See the Patchstack advisory for further technical context. No public proof-of-concept exploit code has been released.

Detection Methods for CVE-2025-63035

Indicators of Compromise

Suspicious URL parameters or URL fragments containing <script> tags, javascript: URIs, or encoded HTML entities directed at WPLMS pages.
Outbound requests from user browsers to unfamiliar domains shortly after visiting WPLMS course, profile, or dashboard pages.
Unexpected session token exfiltration or WordPress admin actions originating from LMS user sessions.

Detection Strategies

Inspect web server access logs for requests to WPLMS endpoints containing HTML control characters, on*= event handlers, or javascript: schemes in query strings.
Deploy a Web Application Firewall (WAF) rule set that flags common XSS payload patterns targeting WordPress plugin URLs.
Use browser-based Content Security Policy (CSP) violation reporting to surface unexpected inline script execution on pages served by WPLMS.

Monitoring Recommendations

Monitor WordPress audit logs for privilege changes, new administrator accounts, or plugin modifications following user visits to crafted URLs.
Alert on anomalous JavaScript execution patterns and cross-origin requests originating from LMS pages.
Track the installed WPLMS plugin version across managed WordPress deployments to identify hosts still running <= 1.9.9.5.4.

How to Mitigate CVE-2025-63035

Immediate Actions Required

Identify all WordPress instances running the WPLMS wplms_plugin and confirm the installed version.
Update WPLMS to a version later than 1.9.9.5.4 as soon as the vendor releases a fixed build. Consult the Patchstack advisory for patched version information.
Rotate session cookies and force reauthentication for privileged LMS users if suspicious activity is observed.

Patch Information

VibeThemes has been notified through Patchstack's coordinated disclosure process. Site administrators should apply the vendor-supplied update for WPLMS versions above 1.9.9.5.4 when available. Verify the update through the WordPress plugin dashboard and confirm the version string after installation.

Workarounds

Deploy a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins, reducing the impact of DOM-based injection.
Place a WAF in front of the WordPress site with rules that block XSS payloads in query strings and fragments targeting WPLMS endpoints.
Restrict LMS user registration and limit privileges for course authors until the plugin is patched.

bash

# Example WP-CLI check for WPLMS plugin version
wp plugin list --name=wplms_plugin --fields=name,status,version

# Example nginx rule to block obvious XSS payloads in query strings
if ($args ~* "(<|%3C)script") { return 403; }