CVE-2025-22498 HIGH

CVE-2025-22498: WordPress LucidLMS plugin <= 1.0.5 - Reflected Cross Site Scripting (XSS) vulnerability

Vendor N3Wnormal
Product LucidLMS
Weakness CWE-79 · XSS
Published January 13, 2025
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in N3wNormal LucidLMS lucidlms allows Reflected XSS.This issue affects LucidLMS: from n/a through <= 1.0.5.

Explanation of Vulnerability in Simple Terms

02Summary

LucidLMS versions 1.0.5 and earlier contain a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. The vulnerability requires user interaction—victims must click a malicious link or visit a crafted page. Successful exploitation can compromise user sessions, steal credentials, or deface site content.

What an attacker can do

03Attacker Capabilities

Inject malicious JavaScript that runs in other users' browsers when they visit a crafted link.

Potential impact on your site

04Site Impact

Users' sessions and credentials can be stolen; site content can be defaced or modified in users' browsers.

Conditions required to exploit

05Prerequisites

No authentication required. Victim must click a malicious link or visit an attacker-controlled page.

Key dates

06Disclosure timeline

January 13, 2025 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-15730 GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'heading_size' Shortcode Attribute CVE-2026-13440 StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Unauthenticated Stored Cross-Site Scripting via 'message_popup' Parameter CVE-2026-12231 Exclusive Addons for Elementor <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'exad_infobox_image' CVE-2026-65511 WordPress Manual - Documentation, Knowledge Base & Education WordPress Theme theme <= 7.5.4 - Cross Site Scripting (XSS) vulnerability CVE-2026-15644 Powerkit <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute