CVE-2025-67536

CWE-79 — Cross-site Scripting (XSS)4 documents4 sources

Severity

6.5MEDIUM

EPSS

0.1%

top 80.20%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Thimpress Learnpress

Timeline

PublishedDec 9

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress LearnPress learnpress allows Stored XSS.This issue affects LearnPress: from n/a through <= 4.2.9.4.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:LExploitability: 2.3 | Impact: 3.7

Affected Packages1 packages

▶CVEListV5thimpress/learnpress4.2.9.4

🔴Vulnerability Details

GHSA

GHSA-j934-wxvm-8fw9: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress LearnPress learnpress allows Stored XS↗2025-12-09

▶

CVEList

WordPress LearnPress plugin <= 4.2.9.4 - Cross Site Scripting (XSS) vulnerability↗2025-12-09

▶

🕵️Threat Intelligence

Wiz

CVE-2025-67536 Impact, Exploitability, and Mitigation Steps | Wiz↗

▶