CVE-2024-3560 — Cross-site Scripting in Learnpress

CWE-79 — Cross-site Scripting3 documents3 sources
Severity
5.4MEDIUMNVD
CNA6.4
EPSS
0.2%
top 61.92%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Thimpress LearnpressThimpress Learnpress Wordpress LMS Plugin FOR Create AND Sell Online Courses
Timeline
PublishedApr 19

Description

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the _id value in all versions up to, and including, 4.2.6.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages2 packages

▶NVDthimpress/learnpress< 4.2.6.5

🔴Vulnerability Details

2
CVEList
LearnPress – WordPress LMS Plugin <= 4.2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting↗2024-04-19
▶
GHSA
GHSA-4qwp-4p88-ww2v: The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the _id value in all versions up to, and i↗2024-04-19
▶
CVE-2024-3560 — Cross-site Scripting in Learnpress | cvebase