WordPress Plugin Vulnerabilities

LearnPress < 4.1.6 - Reflected Cross-Site Scripting

Description

The plugin does not sanitise and escape the lp-dismiss-notice before outputting it back via the lp_background_single_email AJAX action, leading to a Reflected Cross-Site Scripting

Proof of Concept

Affects Plugins

Plugin icon
learnpress
Fixed in 4.1.6

References

CVE
CVE-2022-0271

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Original Researcher
Krzysztof Zając
Submitter
Krzysztof Zając
Submitter website
https://kazet.cc/
Verified
Yes
WPVDB ID
ad07d9cd-8a75-4f7c-bbbe-3b6b89b699f2

Timeline

Publicly Published
2022-03-16 (about 3 years ago)
Added
2022-03-16 (about 3 years ago)
Last Updated
2022-04-11 (about 3 years ago)

Other

Published
Title
Published
2025-09-05
Title
金数据 <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2023-04-06
Title
Maps Widget for Google Maps < 4.25 - Admin+ Stored XSS
Published
2025-10-09
Title
Post List Featured Image <= 0.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2016-08-15
Title
Google Maps <= 2.1.3 - Authenticated Reflected Cross-Site Scripting (XSS)
Published
2022-10-21
Title
Quiz And Survey Master < 7.3.5 - Contributor+ Stored Cross-Site Scripting