Medium severity6.4NVD Advisory· Published May 10, 2026· Updated May 12, 2026

CVE-2021-47907

Description

Rocket LMS 1.1 contains a persistent cross-site scripting vulnerability in the support ticket module that allows authenticated users to inject malicious script code through the title parameter. Attackers can submit support tickets with embedded HTML/JavaScript payloads that execute in the browsers of other users viewing the message history, enabling session hijacking and phishing attacks.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Lmsllm-fuzzy
Range: = 1.1
Package: https://wordpress.org/themes/lms

Patches

Vulnerability mechanics

References

lms.rocket-soft.orgnvd
www.exploit-db.com/exploits/50677nvd
www.vulncheck.com/advisories/rocket-lms-persistent-cross-site-scripting-via-support-ticketsnvd

News mentions

No linked articles in our index yet.

cvss	0.416
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000