CVE-2024-12127

Published
View on NVD ↗
CVSS v3
6.1
MEDIUM
CVSS v2
N/A
Affected
1
PROJECT

Description

The Learning Management System, eLearning, Course Builder, WordPress LMS Plugin – Sikshya LMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page’ parameter in all versions up to, and including, 0.0.21 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

<p>Sikshya LMS — WordPress learning management plugin for online courses, quizzes, Stripe/PayPal checkout, certificates, and learner dashboards on your domain.</p> <p><strong>Sikshya LMS</strong> is a <strong>WordPress LMS</strong> (learning management system) for educators and creators who want students to enroll, learn, and pay without leaving the site. It installs like other WordPress plugins: you control hosting, data, and branding. The free core lets you launch a real course catalog, sell when you are ready, and upgrade to <strong>Sikshya Pro</strong> when you need automation and advanced add-ons.</p> <h3>At a glance</h3> <ul> <li><strong>Sell</strong> — Free or paid online courses with Stripe and PayPal, coupons, and orders via <a href="https://mantrabrain.com/plugins/sikshya-lms/features/native-checkout/?utm_source=wporg&amp;utm_medium=readme&amp;utm_campaign=feature_native_checkout" rel="nofollow ugc">native checkout</a> in the free core.</li> <li><strong>Teach</strong> — Visual <a href="https://mantrabrain.com/plugins/sikshya-lms/features/course-builder/?utm_source=wporg&amp;utm_medium=readme&amp;utm_campaign=feature_course_builder" rel="nofollow ugc">course builder</a>, structured curriculum, <a href="https://mantrabrain.com/plugins/sikshya-lms/features/video-text-lessons/?utm_source=wporg&amp;utm_medium=readme&amp;utm_campaign=feature_video_text_lessons" rel="nofollow ugc">video &amp; text lessons</a>, <a href="https://mantrabrain.com/plugins/sikshya-lms/features/quizzes/?utm_source=wporg&amp;utm_medium=readme&amp;utm_campaign=feature_quizzes" rel="nofollow ugc">quizzes &amp; auto-grading</a>, assignments, and <a href="https://mantrabrain.com/plugins/sikshya-lms/features/basic-certificates/?utm_source=wporg&amp;utm_medium=readme&amp;utm_campaign=feature_basic_certificates" rel="nofollow ugc">course certificates</a>.</li> <li><strong>Support learners</strong> — Dashboards, progress, wishlist, and role-aware flows for instructors and staff.</li> </ul> <h3>Quick links</h3> <p>👉 <a href="https://sikshya.mantrabrain.com/docs/?utm_source=wporg&amp;utm_medium=readme&amp;utm_campaign=documentation" rel="nofollow ugc">Documentation</a></p> <p>👉 <a href="https://try.new/plugins/sikshya/" rel="nofollow ugc">Try Sikshya LMS Free</a></p> <p>👉 <a href="https://try.mantrabrain.com/try-sikshya-pro/" rel="nofollow ugc">Try Sikshya LMS Pro</a></p> <p>👉 <a href="https://mantrabrain.com/plugins/sikshya-lms/?utm_source=wporg&amp;utm_medium=readme&amp;utm_campaign=home" rel="nofollow ugc">Sikshya LMS — product &amp; pricing</a></p> <p>👉 <a href="https://mantrabrain.com/plugins/sikshya-lms/?utm_source=wporg&amp;utm_medium=readme&amp;utm_campaign=pro" rel="nofollow ugc">Sikshya Pro</a></p> <p>👉 <a href="https://www.facebook.com/groups/sikshyalms/" rel="nofollow ugc">Sikshya LMS Facebook Community</a></p> <p>👉 <a href="https://mantrabrain.com/plugins/sikshya-lms/?utm_source=wporg&amp;utm_medium=readme&amp;utm_campaign=compare#compare" rel="nofollow ugc">Compare Sikshya with LearnDash, Tutor LMS, LifterLMS, LearnPress, MemberPress</a></p> <p>Join the community for release notes, setup tips, and peer discussion with other WordPress course creators.</p> <span class="embed-youtube" style="text-align:center; display: block;"><iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/CF1p9slkQrg?version=3&#038;rel=1&#038;showsearch=0&#038;showinfo=1&#038;iv_load_policy=1&#038;fs=1&#038;hl=en-US&#038;autohide=2&#038;wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe></span> <h3>Why choose Sikshya?</h3> <ul> <li><strong>Creator-first workflow</strong> — A fast admin experience (React-powered shell) so you spend time teaching, not hunting through scattered WordPress screens.</li> <li><strong>Commerce that belongs in the free core</strong> — Paid courses, coupons, orders, and mainstream gateways are part of the baseline story—not an afterthought locked behind “contact sales.”</li> <li><strong>Sensible defaults</strong> — Fewer knobs on day one; advanced automation, marketplace, and reporting unlock with <strong>Sikshya Pro</strong> when you are ready to scale.</li> <li><strong>WordPress-native</strong> — Courses, lessons, quizzes, and questions follow familiar custom post types and capabilities, with REST-oriented services where documented—so agencies and developers can extend predictably.</li> <li><strong>Compatible with your stack</strong> — Works with the WordPress block editor (Gutenberg), Classic Editor, and popular page builders such as Elementor and Divi alongside your existing theme.</li> </ul> <h3>Self-hosted WordPress LMS — curriculum, quizzes, checkout, and certificates</h3> <p>Install Sikshya on <strong>your</strong> WordPress site to keep ownership of course content, learner records, and payments—without renting a separate SaaS LMS just to deliver training.</p> <p><strong>In plain English:</strong> you create courses in the WordPress admin; learners open your course pages on the front of your site, track progress in their account, and complete quizzes or assignments you publish.</p> <p>Use Sikshya for coaching, professional training, customer education, internal onboarding, or the start of a course marketplace—with full control of content, branding, and revenue.</p> <h3>New to WordPress LMS plugins?</h3> <ul> <li><strong>No code required</strong> to publish lessons and quizzes—you work inside Sikshya’s admin screens like other WordPress plugins.</li> <li><strong>Your theme</strong> controls fonts and many layout basics; Sikshya adds course templates and learner views so selling and learning stay consistent.</li> <li><strong>Start small:</strong> create one course, one short lesson, and one quiz; invite a test student account before you invite paying customers.</li> <li><strong>Payments are optional:</strong> offer free courses first, then connect Stripe or PayPal when you sell.</li> </ul> <h3>Who is Sikshya for?</h3> <ul> <li><strong>Coaches, consultants, and creators</strong> shipping paid programs without hiring a platform team.</li> <li><strong>Training companies &amp; academies</strong> replacing spreadsheets with enrollments, progress, and assessments.</li> <li><strong>Teams doing internal training</strong> who need completion tracking and light certification.</li> <li><strong>Agencies</strong> standardizing one dependable LMS layer across client sites (including multisite when configured carefully).</li> </ul> <h3>Extended use cases</h3> <ul> <li><strong>Blended learning</strong> — Self-paced lessons plus scheduled touchpoints (extended live tooling ships in Pro where applicable).</li> <li><strong>Customer education</strong> — Product training and onboarding academies tied to your brand site.</li> <li><strong>Community &amp; cohort programs</strong> — Clear curriculum and progress signals; pair with your favorite community plugins as needed.</li> </ul> <h3>Top features (free core)</h3> <p>Each headline below links to its dedicated feature page on the Sikshya site.</p> <p><strong><a href="https://mantrabrain.com/plugins/sikshya-lms/features/course-builder/?utm_source=wporg&amp;utm_medium=readme&amp;utm_campaign=feature_course_builder" rel="nofollow ugc">Course Builder</a></strong> — curriculum + chapters</p> <ul> <li>Unlimited courses, lessons, and quizzes (within your hosting limits).</li> <li>Structured curriculum with sections/chapters and drag-and-drop style ordering.</li> <li>Course landing content: descriptions, FAQs, announcements, preview lessons.</li> <li>Course archive with search and filters aligned to your theme.</li> </ul> <p><strong><a href="https://mantrabrain.com/plugins/sikshya-lms/features/video-text-lessons/?utm_source=wporg&amp;utm_medium=readme&amp;utm_campaign=feature_video_text_lessons" rel="nofollow ugc">Video &amp; Text Lessons</a></strong> — multi-format content</p> <ul> <li>Lesson types: text, video via URL/embed-style delivery, downloadable materials.</li> <li>Optional transcript field (downloadable URL + paste-in text) for accessibility and SEO.</li> <li>Graceful media fallback when an embed or source can&#8217;t load.</li> </ul> <p><strong><a href="https://mantrabrain.com/plugins/sikshya-lms/features/quizzes/?utm_source=wporg&amp;utm_medium=readme&amp;utm_campaign=feature_quizzes" rel="nofollow ugc">Quizzes &amp; Auto-grading</a></strong> — assessment that actually scales</p> <ul> <li>Quiz builder: multiple choice, true/false, short answer, essay, fill-in-the-blank, ordering, matching.</li> <li>Passing marks, attempts, and timer-oriented assessment controls.</li> <li>Sequential progression and chapter-style gating where configured.</li> <li>Mid-attempt auto-save so a refresh doesn&#8217;t wipe in-progress answers.</li> <li>Per-type score breakdown + optional per-question explanations on review.</li> <li>Assignments with submission and manual grading for real-world evaluation.</li> </ul> <p><strong><a href="https://mantrabrain.com/plugins/sikshya-lms/features/basic-certificates/?utm_source=wporg&amp;utm_medium=readme&amp;utm_campaign=feature_basic_certificates" rel="nofollow ugc">Course Certificates</a></strong> — issued on completion</p> <ul> <li>Two ready-to-use certificate templates (Heritage + Vertex) ship in the free core, marked default so they survive updates.</li> <li>PDF download from the learner profile when a course is completed.</li> <li>QR-based external verification ships in the <strong>Pro</strong> <a href="https://mantrabrain.com/plugins/sikshya-lms/features/certificates-advanced/?utm_source=wporg&amp;utm_medium=readme&amp;utm_campaign=feature_certificates_advanced" rel="nofollow ugc">Advanced certificates</a> addon.</li> </ul> <p><strong>Learners</strong></p> <ul> <li>Student dashboard: enrollments, progress, resume learning.</li> <li>Wishlist for saved courses.</li> <li>Role-aware flows for administrators and instructors.</li> </ul> <p><strong><a href="https://mantrabrain.com/plugins/sikshya-lms/features/native-checkout/?utm_source=wporg&amp;utm_medium=readme&amp;utm_campaign=feature_native_checkout" rel="nofollow ugc">Native checkout</a></strong> — checkout &amp; monetization (free baseline)</p> <ul> <li>Free courses, paid courses, and manual enrollment by staff.</li> <li>Stripe and PayPal as first-class payment paths in settings.</li> <li>Coupons: percentage or fixed discounts, redemption limits, optional date windows.</li> <li>Order management: visibility, notes, and administrative refund-style workflows as implemented per release.</li> </ul> <p><strong>Reliability &amp; operations</strong></p> <ul> <li>Capability checks, nonces, and disciplined REST patterns aligned with WordPress security expectations.</li> <li>Transactional email hooks for enrollment, purchase, and completion journeys (templates evolve by release).</li> <li>Translation-ready (<code>sikshya</code> text domain); RTL-friendly layouts are a continuous improvement target—report theme-specific gaps via support.</li> </ul> <h3>Native commerce &amp; checkout</h3> <p>Sell access without duct-taping five plugins together for a basic launch: configure gateways, test in sandbox or test mode when available, publish your course page, and route buyers through a <a href="https://mantrabrain.com/plugins/sikshya-lms/features/native-checkout/?utm_source=wporg&amp;utm_medium=readme&amp;utm_campaign=feature_native_checkout" rel="nofollow ugc">checkout experience</a> designed for digital education—not generic cart prose bolted onto an LMS.</p> <h3>Platform notes</h3> <ul> <li><strong>Themes</strong> — Built to cooperate with well-coded WordPress themes; use a default theme briefly if you need to isolate CSS conflicts.</li> <li><strong>Multisite</strong> — Network-enabled; validate roles, capabilities, and data boundaries per site before production.</li> <li><strong>Developers</strong> — Hooks and filters around enrollments, lesson completion, and quiz outcomes; REST coverage is summarized on the product site and expanded in <a href="https://sikshya.mantrabrain.com/docs/?utm_source=wporg&amp;utm_medium=readme&amp;utm_campaign=documentation" rel="nofollow ugc">Sikshya documentation</a>.</li> </ul> <h3>Upgrade to Sikshya Pro</h3> <p>Unlock advanced <a href="https://mantrabrain.com/plugins/sikshya-lms/features/content-drip/?utm_source=wporg&amp;utm_medium=readme&amp;utm_campaign=feature_content_drip" rel="nofollow ugc">content drip</a> and <a href="https://mantrabrain.com/plugins/sikshya-lms/features/prerequisites/?utm_source=wporg&amp;utm_medium=readme&amp;utm_campaign=feature_prerequisites" rel="nofollow ugc">prerequisites</a>, <a href="https://mantrabrain.com/plugins/sikshya-lms/features/multi-instructor/?utm_source=wporg&amp;utm_medium=readme&amp;utm_campaign=feature_multi_instructor" rel="nofollow ugc">multi-instructor</a> collaboration, <a href="https://mantrabrain.com/plugins/sikshya-lms/features/subscriptions/?utm_source=wporg&amp;utm_medium=readme&amp;utm_campaign=feature_subscriptions" rel="nofollow ugc">subscriptions</a>, deeper <a href="https://mantrabrain.com/plugins/sikshya-lms/features/reports-advanced/?utm_source=wporg&amp;utm_medium=readme&amp;utm_campaign=feature_reports_advanced" rel="nofollow ugc">analytics</a> and <a href="https://mantrabrain.com/plugins/sikshya-lms/features/gradebook/?utm_source=wporg&amp;utm_medium=readme&amp;utm_campaign=feature_gradebook" rel="nofollow ugc">gradebook</a> workflows, <a href="https://mantrabrain.com/plugins/sikshya-lms/features/course-bundles/?utm_source=wporg&amp;utm_medium=readme&amp;utm_campaign=feature_course_bundles" rel="nofollow ugc">course bundles</a>, <a href="https://mantrabrain.com/plugins/sikshya-lms/features/white-label/?utm_source=wporg&amp;utm_medium=readme&amp;utm_campaign=feature_white_label" rel="nofollow ugc">white-label</a> options, and broader integrations. <strong>Free stays generous; Pro unlocks scale.</strong></p> <p>👉 <a href="https://mantrabrain.com/plugins/sikshya-lms/pricing/?utm_source=wporg&amp;utm_medium=readme&amp;utm_campaign=pro_detail" rel="nofollow ugc">Explore Sikshya Pro</a></p> <p>👉 <a href="https://mantrabrain.com/plugins/sikshya-lms/pricing/?utm_source=wporg&amp;utm_medium=readme&amp;utm_campaign=plans" rel="nofollow ugc">Sikshya pricing &amp; plans</a></p> <h3>Sikshya Pro add-on catalog</h3> <p>Below is the full commercial add-on line-up from the Sikshya feature registry. <strong>Each title links to pricing</strong> so you can compare plans. Availability varies by plan tier (Starter, Growth / Pro band, Scale); see the pricing page for the current matrix.</p> <h4>Starter-band add-ons</h4> <ul> <li> <p><strong><a href="https://mantrabrain.com/plugins/sikshya-lms/features/content-drip/?utm_source=wporg&amp;utm_medium=readme&amp;utm_campaign=feature_content_drip" rel="nofollow ugc">Content drip &amp; scheduled unlock</a></strong> — Release lessons over time (“day 3 after signup”, dates, cohort pace) instead of opening the full catalog on day one. Best for paced programs and term-style delivery; disable for purely self‑paced libraries.</p> </li> <li> <p><strong><a href="https://mantrabrain.com/plugins/sikshya-lms/features/course-reviews/?utm_source=wporg&amp;utm_medium=readme&amp;utm_campaign=feature_course_reviews" rel="nofollow ugc">Course reviews &amp; ratings</a></strong> — Collect star ratings and written reviews on course pages with moderation before they go live. Builds social proof in the catalog; turn off when public reviews don’t fit your model.</p> </li> <li> <p><strong><a href="https://mantrabrain.com/plugins/sikshya-lms/features/prerequisites/?utm_source=wporg&amp;utm_medium=readme&amp;utm_campaign=feature_prerequisites" rel="nofollow ugc">Prerequisites (lessons &amp; courses)</a></strong> — Require completion of chosen lessons or whole courses before the next step unlocks—ideal for sequencing, compliance, or leveled paths. Leave off when every course stands alone.</p> </li> <li> <p><strong><a href="https://mantrabrain.com/plugins/sikshya-lms/features/instructor-dashboard/?utm_source=wporg&amp;utm_medium=readme&amp;utm_campaign=feature_instructor_dashboard" rel="nofollow ugc">Instructor dashboard</a></strong> — Gives each teacher a concise snapshot (e.g. enrollments on their courses) without sharing the whole admin site. Useful when instructors should see <strong>their</strong> numbers only.</p> </li> <li> <p><strong><a href="https://mantrabrain.com/plugins/sikshya-lms/features/drip-notifications/?utm_source=wporg&amp;utm_medium=readme&amp;utm_campaign=feature_drip_notifications" rel="nofollow ugc">Drip &amp; automation emails</a></strong> — Optional transactional emails when drip rules unlock lessons or schedules (templates in Email templates). Pair with Content drip when you want “lesson unlocked” style notices.</p> </li> <li> <p><strong><a href="https://mantrabrain.com/plugins/sikshya-lms/features/calendar/?utm_source=wporg&amp;utm_medium=readme&amp;utm_campaign=feature_calendar" rel="nofollow ugc">Calendar</a></strong> — Shows learners a dated schedule—enrollments, upcoming drip unlocks, assignment due dates—on My account plus REST data for custom UIs. Handy when deadlines and releases should appear in one place.</p> </li> </ul> <h4>Growth-band add-ons</h4> <ul> <li> <p><strong><a href="https://mantrabrain.com/plugins/sikshya-lms/features/email-advanced-customization/?utm_source=wporg&amp;utm_medium=readme&amp;utm_campaign=feature_email_advanced" rel="nofollow ugc">Professional email delivery &amp; branded templates</a></strong> — Route Sikshya emails through a proper ESP (SendGrid-style setup) and wrap messages with your branding. Improve deliverability versus generic PHP mail.</p> </li> <li> <p><strong><a href="https://mantrabrain.com/plugins/sikshya-lms/features/community-discussions/?utm_source=wporg&amp;utm_medium=readme&amp;utm_campaign=feature_discussions" rel="nofollow ugc">Course discussions &amp; Q&amp;A</a></strong> — In-course discussions and Q&amp;A with instructor moderation for cohort-led learning. Skip when comments are handled entirely outside Sikshya.</p> </li> <li> <p><strong><a href="https://mantrabrain.com/plugins/sikshya-lms/features/multi-instructor/?utm_source=wporg&amp;utm_medium=readme&amp;utm_campaign=feature_multi_instructor" rel="nofollow ugc">Multi-instructor &amp; co-authors</a></strong> — Assign multiple instructors per course with optional revenue splits for shared authoring and payouts. Keeps ledger-style splits disciplined at checkout.</p> </li> <li> <p><strong><a href="https://mantrabrain.com/plugins/sikshya-lms/features/reports-advanced/?utm_source=wporg&amp;utm_medium=readme&amp;utm_campaign=feature_reports_advanced" rel="nofollow ugc">Advanced analytics &amp; exports</a></strong> — Download enrollment-style and progress-ready data for Excel/Sheets and offline planning. Bridges dashboard charts and spreadsheets when stakeholders need files.</p> </li> <li> <p><strong><a href="https://mantrabrain.com/plugins/sikshya-lms/features/gradebook/?utm_source=wporg&amp;utm_medium=readme&amp;utm_campaign=feature_gradebook" rel="nofollow ugc">Gradebook</a></strong> — Consolidates quizzes and graded assignments into a per‑learner, per‑course scores view plus export workflows. Targets real grading—not “completion only.”</p> </li> <li> <p><strong><a href="https://mantrabrain.com/plugins/sikshya-lms/features/activity-log/?utm_source=wporg&amp;utm_medium=readme&amp;utm_campaign=feature_activity_log" rel="nofollow ugc">Student activity log</a></strong> — Timeline of milestones (enrollment, completions, quizzes, submissions, checkout) when you must answer <strong>what happened, when</strong>. Helpful support and dispute trail.</p> </li> <li> <p><strong><a href="https://mantrabrain.com/plugins
WordPress Plugin DirectoryWordPress Plugin Directory
14.4K