CVE-2022-0271 LearnPress < 4.1.6 - Reflected Cross-Site Scripting

2022-04-1114:40:41

CWE-79

WPScan

www.cve.org

0.001 Low

EPSS

Percentile

43.6%

JSON

The LearnPress WordPress plugin before 4.1.6 does not sanitise and escape the lp-dismiss-notice before outputting it back via the lp_background_single_email AJAX action, leading to a Reflected Cross-Site Scripting

CNA Affected

[
  {
    "product": "LearnPress – WordPress LMS Plugin",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "4.1.6",
        "status": "affected",
        "version": "4.1.6",
        "versionType": "custom"
      }
    ]
  }
]