Lucene search
WpvulndbWPVDB-ID:3ED9A1F6-8798-4B80-B254-7B8E9CED3DC7HistoryOct 18, 2021 - 12:00 a.m.
LearnPress < 4.1.3.2 - Admin+ Stored Cross-Site Scripting
2021-10-1800:00:00
wpscan.com
7
learnpress
vulnerability
stored cross-site scripting
admin+
web scripts
multi-site installations
unfiltered_html
EPSS
0.001
Percentile
37.9%
The plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping on the $custom_profile parameter found in the ~/inc/admin/views/backend-user-profile.php file which allowed attackers with administrative user access to inject arbitrary web scripts. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
Related
checkpoint_advisories
checkpoint_advisories
WordPress LearnPress Plugin Cross-Site Scripting (CVE-2021-39348)
2021-12-28 00:00:00
cnvd
cnvd
WordPress Cross-Site Scripting Vulnerability (CNVD-2021-83666)
2021-10-25 00:00:00
openvas
openvas
WordPress LearnPress Plugin < 4.1.3.2 XSS Vulnerability
2021-11-03 00:00:00
patchstack
patchstack
cvelist
cvelist
cve
cve
CVE-2021-39348
2021-10-21 20:15:07
prion
prion
Cross site scripting
2021-10-21 20:15:00
nvd
nvd
CVE-2021-39348
2021-10-21 20:15:07