CVE-2026-34606 is a stored cross-site scripting (CWE-79) vulnerability in Frappe LMS affecting versions 2.27.0 through 2.47.x. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that persist in the system. This can lead to client-side code execution when users view the affected content. The vulnerability has been fixed in version 2.48.0. The CVSS 4.0 vector indicates the attack is network accessible, requires no privileges or user interaction, and has limited impact on integrity but no impact on confidentiality or availability.

Successful exploitation of this stored XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of users' browsers when they access affected pages. This may lead to session hijacking, defacement, or other client-side attacks. However, the impact is limited to integrity with no direct confidentiality or availability impact as per the CVSS vector. There are no reports of active exploitation in the wild.

Users and administrators of Frappe LMS should upgrade to version 2.48.0 or later, where this vulnerability has been patched. Since this is a software vulnerability in a non-cloud product, applying the official update is the recommended remediation. Patch status is confirmed by the vendor advisory stating the issue is fixed in version 2.48.0.