This vulnerability affects CodeCanyon Rocket LMS up to version 2.2 in the Student Profile Image Upload functionality. An attacker can remotely manipulate input to trigger cross-site scripting, potentially allowing execution of arbitrary scripts in the context of the victim's browser. The vulnerability has been publicly disclosed, but no official vendor response or patch is available. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and low impact on confidentiality and integrity.

Successful exploitation allows remote attackers to execute arbitrary scripts in the context of users interacting with the vulnerable component, potentially leading to session hijacking, defacement, or other client-side attacks. The impact is limited to the client side and requires user interaction. There is no indication of server-side compromise or data breach from the provided data.

No official patch or vendor advisory is available. Users of affected versions (2.0, 2.1, 2.2) should consider implementing input validation and output encoding on the Student Profile Image Upload component as a temporary mitigation. Monitor for updates from the vendor for an official fix. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.