CVE-2025-9125: Cross-Site Scripting Flaw in Lectora Courses Puts E-Learning Platforms at Risk

CVE-2025-9125 is a cross-site scripting flaw in Lectora that affects both desktop and cloud-based versions when certain publishing settings are enabled, according to CERT/CC note. The vulnerability arises from improper handling of crafted URL parameters in courses published with affected versions, allowing malicious JavaScript injection. Exploitation could result in client-side script execution, which poses a risk of session hijacking or user redirection, CERT/CC explains.

The affected software releases include Lectora Inspire and Lectora Publisher (desktop editions) versions 21.0–21.3 and Lectora Online versions 7.1.6 and older, with the flaw first patched in Lectora Desktop version 21.4 (25 October 2022) but without a clear republishing instruction in the release notes.

The note stresses that republishing is required to apply the fix, and Lectora Online was automatically updated to version 7.1.7 on 20 July 2025, though older courses still need republishing for the fix to take effect. Users are urged to upgrade to 21.4 or later on desktop and to republish all previously created courses to ensure patched output.