Medium severity · published Apr 2, 2026
CVE-2026-34606
Stored XSS in Frappe LMS
6.1
CVSS
0.2%
EPSS
No
On KEV
Description
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. From version 2.27.0 to before version 2.48.0, Frappe LMS was vulnerable to stored XSS. This issue has been patched in version 2.48.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 10% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LM
lms · frappe
>= 2.27.0, < 2.48.0 · source: vendor
LE
Learning · Frappe
2.27.0 before 2.48.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-34606
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-34606
Patch
https://github.com/frappe/lms/commit/b8283860a7f029ea2fa0245131c398c079088921
Issue Tracking
https://github.com/frappe/lms/pull/2185
Product
https://github.com/frappe/lms/releases/tag/v2.48.0
Vendor Advisory
https://github.com/frappe/lms/security/advisories/GHSA-qf5w-r34q-c7j2
More from lms
9.4
CVE-2026-39405
Frappe has Path Transversal via SCORM
8.8
CVE-2025-55006
Frappe Learning Holds Potential for Malicious SVG Upload in Image Upload Feature
8.7
CVE-2026-54343
Frappe LMS: Path Traversal in SCORM File Serving
7.1
CVE-2026-39385
Frappe LMS enrollment bypass in paid courses via unrelated batch
6.5
CVE-2025-66581
Frappe LMS is Missing Server-Side Authorization in Business Logic