CVE-2025-63035
Medium · 6.5CVSS
6.5
EPSS
0.2%
Published
Dec 9, 2025
CISA due date
—
The record
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VibeThemes WPLMS wplms_plugin allows DOM-Based XSS.This issue affects WPLMS: from n/a through <= 1.9.9.5.4.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|