WordPress Plugin Vulnerabilities

WP Courses LMS < 2.0.44 - Reflected Cross-Site Scripting

Description

The plugin does not escape some parameters before outputting them back in admin pages, leading to Reflected Cross-Site Scripting issues

Proof of Concept

Affects Plugins

Plugin icon
wp-courses
Fixed in 2.0.44

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
WPScanTeam
Verified
Yes
WPVDB ID
71585f09-4075-4a0c-ab05-45a5d6f6ce9b

Timeline

Publicly Published
2021-08-16 (about 4 years ago)
Added
2021-08-16 (about 4 years ago)
Last Updated
2021-08-16 (about 4 years ago)

Other

Published
Title
Published
2025-04-23
Title
MangBoard WP < 1.8.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via Board Header And Footer
Published
2026-03-20
Title
Image Slider by Ays- Responsive Slider and Carousel < 2.7.2 - Unauthenticated Stored Cross-Site Scripting
Published
2025-07-23
Title
Responsive HTML5 Audio Player PRO With Playlist < 3.5.9 - Reflected Cross-Site Scripting
Published
2025-01-16
Title
GravityForms 2.9.0.1 - 2.9.1.3 - Unauthenticated Stored Cross-Site Scripting via 'style_settings' parameter
Published
2023-02-24
Title
Sp*tify Play Button for WordPress < 2.06 - Contributor+ Stored XSS