The plugin does not sanitise and escape the Email PDT identity token settings, which could allow high privilege users to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Visit to Paypal Setting Under Learning Plugin Enter the XSS payload (">) in Email PDT identity token Field and Click on Save Changes. Visit the Import/Export Tab to trigger the XSS
CPE | Name | Operator | Version |
---|---|---|---|
nd-learning | lt | 5.0 |