Learning Courses < 5.0 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape the Email PDT identity token settings, which could allow high privilege users to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

Visit to Paypal Setting Under Learning Plugin
Enter the XSS payload ("><img src=x onerror=alert(1)>) in Email PDT identity token Field and Click on Save Changes.
Visit the Import/Export Tab to trigger the XSS