CVE-2023-50875 WordPress Sensei LMS Plugin <= 4.17.0 is vulnerable to Cross Site Scripting (XSS)

What is CVE-2023-50875?

CVE-2023-50875 is a medium-severity cross-site scripting vulnerability in Automattic Sensei LMS – Online Courses, Quizzes, & Learning, published on 12 Feb 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic Sensei LMS – Online Courses, Quizzes, & Learning allows Stored XSS.This issue affects Sensei LMS – Online Courses, Quizzes, & Learning: from n/a through 4.17.0.

Weakness: CWE-79

Which versions are affected by CVE-2023-50875?

It affects 1 product.

Products include Automattic Sensei Lms.

How do I fix CVE-2023-50875?

No fix has been published for CVE-2023-50875 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2023-50875 being exploited?

There is no known exploitation of CVE-2023-50875 in the wild and no public exploit code.

Other vulnerabilities in Automattic Sensei LMS – Online Courses, Quizzes, & Learning

• CVE-2024-7786 Sensei LMS < 4.24.2 - Unauthenticated Email Template Leak High 7.5
• CVE-2025-0466 Sensei LMS < 4.24.4 - Unauthenticated sensei_email/sensei_message Disclosure Medium 5.3
• CVE-2022-2034 Sensei LMS < 4.5.0 - Unauthenticated Private Messages Disclosure via Rest API Medium 5.3
• CVE-2024-8009 Sensei LMS < 4.20.0 - Teacher+ Users Email Address Disclosure Medium 4.3
• CVE-2022-2080 Sensei LMS < 4.5.2 - Arbitrary Private Message Sending via IDOR Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-rvh5-9v4g-3m8r.