Skip to main content

CISA issues alert on cross-site scripting vulnerability in Lectora products

Source Decision Insights Threat Desk Published November 26, 2025 Companies 2
Human View Machine View

2 companies named across 5 categories, one of 17 articles referencing ONLINE. Previous coverage: Lectora Software XSS Vulnerability Requires Course Republishing (Nov 2025).

Companies mentioned

Best suited for

Persona
Security Operations Practitioner
Decision stage
Post Buy
Adoption curve
Early Majority
Industry
Information Technology / Software & Services / IT Services / Internet Services & Infrastructure

Our classification, not the publisher's statement. Best suited for, not only for.

Lectora Desktop editions 21.0 through 21.3 and Lectora Online versions 7.1.6 and earlier have been found to contain a Cross-Site Scripting (XSS) vulnerability that affects courses published with Seamless Play Publish enabled while Web Accessibility is disabled. This vulnerability may lead to client-side script execution when exploited.

The vulnerability is identified as CVE-2025-9125 and impacts Lectora Inspire and Lectora Publisher desktop versions from 21.0 to 21.3, as well as Lectora Online versions 7.1.6 and older. The issue arises from how courses published with Seamless Play Publish enabled and Web Accessibility disabled handle crafted URL parameters, enabling JavaScript injection. The desktop version patch was released in version 21.4 on October 25, 2022, but requires users to republish existing courses to apply the fix. The update for Lectora Online, version 7.1.7, was deployed on July 20, 2025, with release notes emphasizing the need to republish courses.

Exploitation of this vulnerability could permit client-side script execution such as popups or redirects, which may allow session hijacking or user redirection risks for affected courses.

Patch versions 21.4 for Lectora Desktop (Inspire and Publisher) and 7.1.7 for Lectora Online address the vulnerability. Desktop users must download the patch from portal.elblearning.com and republish any previously created courses to ensure the fix takes effect. Online users received the update automatically but are also required to republish previously created courses.

The Computer Emergency Readiness Team (CERT) Coordination Center has released this advisory to highlight the vulnerability and the necessary remediation steps, reflecting the presence of prominent users including government agencies and large enterprises. Users are advised to follow the official guidance for patching and republishing courses as described.

Blog post, originally published by Laurie Tyzenhaus at kb.cert.org.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/cisa-issues-alert-on-cross-site-scripting-vulnerability-in-lectora-products/",
        "name": "CISA issues alert on cross-site scripting vulnerability in Lectora products",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/cisa-issues-alert-on-cross-site-scripting-vulnerability-in-lectora-products/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@id": "https://decisioninsights.ai/registry/online/#organization",
      "@type": "Organization",
      "mainEntityOfPage": "https://decisioninsights.ai/registry/online/",
      "name": "ONLINE"
    },
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Operations Practitioner"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Early Majority"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Information Technology / Software & Services / IT Services / Internet Services & Infrastructure"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
      "@type": "Person",
      "name": "Decision Insights Threat Desk",
      "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
    },
    "dateModified": "2026-08-23T13:20:42-06:00",
    "datePublished": "2025-11-26T01:28:23-07:00",
    "description": "CISA details cross-site scripting vulnerability in Lectora Desktop 21.0–21.3 and Online 7.1.6 fixed via updates requiring course republishing.",
    "headline": "CISA issues alert on cross-site scripting vulnerability in Lectora products",
    "isBasedOn": {
      "@type": "CreativeWork",
      "author": {
        "@type": "Person",
        "name": "Laurie Tyzenhaus"
      },
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      "url": "https://kb.cert.org/vuls/id/780141"
    },
    "keywords": [
      "Computer Emergency Readiness Team",
      "Cross-Site Scripting",
      "Patch",
      "script",
      "Vulnerabilities"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/cisa-issues-alert-on-cross-site-scripting-vulnerability-in-lectora-products/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-23",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
        "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
      },
      {
        "@id": "https://decisioninsights.ai/registry/online/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/online/",
        "name": "ONLINE"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
    "@type": "Person",
    "description": "CISA advisories, vendor security bulletins, and CVE disclosures, summarized into sourced briefs. Produced under our Standards & Methodology.",
    "name": "Decision Insights Threat Desk",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
  }
]

Is this your company? Get structured data for your own pages