Vulnerability · Published Oct 30, 2026 · Assigned by GitHub_M

CVE-2026-39375Frappe LMS has Stored XSS in Course Meta

Medium 5.1

In plain English

A medium-severity cross-site scripting in lms from frappe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 29% of all known vulnerabilities).

Severity (CVSS 4.0)5.1Medium

Exploit odds (30 days)0.3%top 71.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.0, an authenticated user with a course editing role can inject malicious JavaScript through meta tag fields in the Course Management module. The values are stored without adequate HTML sanitization and are not safely escaped when rendered, allowing stored cross-site scripting. This issue is fixed in version 2.52.0.

Affected products (as reported)

Vendor	Product	Versions
frappe	lms	< 2.52.0

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

References

https://github.com/frappe/lms/security/advisories/GHSA-9fqj-95wr-6hm6 x_refsource_CONFIRM
https://github.com/frappe/lms/commit/cd6aca25f7d28425660720db4fdb920727edb670 x_refsource_MISC
https://github.com/frappe/lms/commit/f244a6c9ff6e0b104fec48b2d97af4cc09896b60 x_refsource_MISC
https://github.com/frappe/lms/tree/v2.52.0 x_refsource_MISC