This vulnerability in Themeum Tutor LMS BunnyNet Integration (up to version 1.0.0) arises from improper neutralization of input during web page generation, resulting in a DOM-based cross-site scripting (XSS) issue. The CVSS 3.1 score is 5.9 (medium severity), with an attack vector of network, low attack complexity, requiring high privileges and user interaction. Successful exploitation can lead to partial compromise of confidentiality, integrity, and availability of the affected system.

Exploitation of this DOM-based XSS vulnerability can allow an attacker with high privileges and requiring user interaction to execute malicious scripts in the context of the affected application, potentially leading to partial disclosure of information, modification of data, or disruption of service. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected plugin and limit user privileges to reduce exploitation risk. Monitor official Themeum communications for updates on patches or mitigations.