CVE-2026-34606

MEDIUM

Stored XSS in Frappe LMS

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2026-34606 has a selected CVSS score of 6.9 (medium).

Description

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. From version 2.27.0 to before version 2.48.0, Frappe LMS was vulnerable to stored XSS. This issue has been patched in version 2.48.0.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 3, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

lms

Browse frappe / lms
CVE List>= 2.27.0, < 2.48.0affected

References

4