What the vulnerability does
01Description
The LearnPress WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping on the $custom_profile parameter found in the ~/inc/admin/views/backend-user-profile.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 4.1.3.1. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled. Please note that this is seperate from CVE-2021-24702.
Explanation of Vulnerability in Simple Terms
02Summary
LearnPress 4.1.3.1 contains a cross-site scripting (XSS) vulnerability that allows high-privilege users to inject malicious scripts affecting other users or the site. The vulnerability requires administrator or equivalent access to exploit. Scope is changed, meaning the impact extends beyond the vulnerable component itself. Update to a version newer than 4.1.3.1.
What an attacker can do
03Attacker Capabilities
Inject malicious scripts that affect other users or site functionality.
Potential impact on your site
04Site Impact
An admin account compromise could allow script injection affecting site visitors or other users.
Conditions required to exploit
05Prerequisites
Attacker must have high-level privileges (administrator or equivalent role).
Key dates
06Disclosure timeline
October 21, 2021
CVE published
February 14, 2025
Record updated
