CVE-2024-4277 — Cross-site Scripting in Learnpress

CWE-79 — Cross-site Scripting4 documents4 sources
Severity
5.4MEDIUMNVD
CNA6.4
EPSS
0.2%
top 58.44%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Thimpress LearnpressThimpress Learnpress Wordpress LMS Plugin FOR Create AND Sell Online Courses
Timeline
PublishedMay 14

Description

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘layout_html’ parameter in all versions up to, and including, 4.2.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages2 packages

▶NVDthimpress/learnpress< 4.2.6.6

🔴Vulnerability Details

2
GHSA
GHSA-8jjw-j8rj-43xm: The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘layout_html’ parameter in all version↗2024-05-14
▶
CVEList
LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via layout_html Parameter↗2024-05-10
▶

💬Community

1
Bugzilla
CVE-2024-27394 kernel: tcp: Fix Use-After-Free in tcp_ao_connect_init↗2024-05-14
▶
CVE-2024-4277 — Cross-site Scripting in Learnpress | cvebase