Lucene search
Shivam RaiWPEX-ID:30635CC9-4415-48BB-9C67-EA670EA1B942HistorySep 20, 2021 - 12:00 a.m.
LearnPress < 4.1.3.1 - Multiple Admin+ Stored Cross-Site Scripting
2021-09-2000:00:00
Shivam Rai
252
0.001 Low
EPSS
Percentile
24.9%
The plugin does not properly sanitize or escape various inputs within course settings, which could allow high privilege users to perform Cross-Site Scripting attacks when the unfiltred_html capability is disallowed
When adding new courses, the following fields can have XSS payloads like "><script>alert(1)</script> injected into them:
- Course Settings > General > External Link field
- Course Settings > Extra Information > Requirements field
- Course Settings > Extra Information > Target Audience field
- Course Settings > Extra Information > Key Features field
- Course Settings > Extra Information > FAQ Title fieldRelated
prion
prion
Cross site scripting
2021-10-18 14:15:00
Cross site scripting
2021-10-21 20:15:00
nvd
nvd
CVE-2021-24702
2021-10-18 14:15:09
CVE-2021-39348
2021-10-21 20:15:07
openvas
openvas
WordPress LearnPress Plugin < 4.1.3.1 XSS Vulnerability
2021-11-03 00:00:00
cvelist
cvelist
wpvulndb
wpvulndb
LearnPress < 4.1.3.1 - Multiple Admin+ Stored Cross-Site Scripting
2021-09-20 00:00:00
cve
cve
CVE-2021-24702
2021-10-18 14:15:09
CVE-2021-39348
2021-10-21 20:15:07
patchstack
patchstack