This vulnerability involves stored XSS in Classroomio LMS 0.1.13, where authenticated attackers can inject malicious scripts via specially crafted SVG cover images. When these images are processed or rendered by the application, the embedded scripts may execute in the context of other users, potentially leading to unauthorized actions or data exposure. The CVSS vector indicates network attack vector, low attack complexity, required privileges, user interaction, and partial impact on confidentiality and integrity without affecting availability.

Successful exploitation can lead to execution of arbitrary code in the context of the victim's browser session, potentially compromising user data confidentiality and integrity within the LMS environment. There is no indication of availability impact. The attack requires the attacker to be authenticated and for the victim to interact with the malicious content.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict SVG uploads or sanitize SVG content to prevent script injection. Limit user privileges to reduce risk and educate users about the dangers of interacting with untrusted content.