CVE-2021-24621 WP Courses LMS < 2.0.44 - Authenticated Stored XSS via Video Embed Code

The WP Courses LMS WordPress plugin before 2.0.44 does not sanitise its Video Embed Code, allowing malicious code to be injected in it by high privilege users, even when the unfilteredhtml capability is disallowed, which could lead to Stored Cross-Site Scripting issues...

PT-2021-16137

Name of the Vulnerable Software and Affected Versions WP Courses LMS WordPress plugin versions prior to 2.0.44 Description The issue allows malicious code to be injected into the Video Embed Code by high privilege users, even when the unfiltered html capability is disallowed, which could lead to...

CVE-2021-24621: Improper Neutralization of Input During Web Page Generation

The WP Courses LMS WordPress plugin before 2.0.44 does not sanitise its Video Embed Code, allowing malicious code to be injected in it by high privilege users, even when the unfilteredhtml capability is disallowed, which could lead to Stored Cross-Site Scripting issues...

WordPress 插件跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports personal blog sites on servers running PHP and MySQL. A security vulnerability exists in the WordPress plugin WP Courses LMS, which stems from the WP Courses LMS...

WordPress WP Courses LMS plugin <= 2.0.43 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Tri Wanda Septian in WordPress WP Courses LMS plugin versions = 2.0.43. Solution Update the WordPress WP Courses LMS plugin to the latest available version at least 2.0.44...

Design/Logic Flaw

The wp-courses plugin through 2.0.27 for WordPress allows remote attackers to bypass the intended payment step for course videos and materials by using the /wp-json REST API, as exploited in the wild in September 2020. This occurs because showinrest is enabled for custom post types e.g.,...

CVE-2020-26876

The wp-courses plugin through 2.0.27 for WordPress allows remote attackers to bypass the intended payment step for course videos and materials by using the /wp-json REST API, as exploited in the wild in September 2020. This occurs because showinrest is enabled for custom post types e.g.,...

CVE-2020-26876

The wp-courses plugin for WordPress (versions

PT-2020-16524

Name of the Vulnerable Software and Affected Versions wp-courses plugin versions prior to 2.0.28 Description The issue allows remote attackers to bypass the intended payment step for course videos and materials. This is achieved by utilizing the /wp-json REST API, with show in rest enabled for...

CVE-2020-26876: Missing Authentication for Critical Function

The wp-courses plugin through 2.0.27 for WordPress allows remote attackers to bypass the intended payment step for course videos and materials by using the /wp-json REST API, as exploited in the wild in September 2020. This occurs because showinrest is enabled for custom post types e.g.,...

VulnCheck KEV: CVE-2020-26876

The wp-courses plugin through 2.0.27 for WordPress allows remote attackers to bypass the intended payment step for course videos and materials by using the /wp-json REST API, as exploited in the wild in September 2020. This occurs because showinrest is enabled for custom post types e.g.,...