CyberRota Analysis
AI-GeneratedThe LearnPress WordPress plugin prior to version 4.4.1 is vulnerable to reflected cross-site scripting due to improper escaping of a search parameter in HTML attributes. This flaw allows an attacker to execute malicious scripts in the browser of a logged-in instructor or administrator who clicks on a specially crafted link, potentially compromising sensitive information or session tokens. WordPress site administrators and users of the LearnPress plugin should prioritize updating to the latest version to mitigate this high-severity risk.
Original NVD Description
The LearnPress WordPress plugin before 4.4.1 does not escape a search parameter before reflecting it into an HTML attribute, leading to Reflected Cross-Site Scripting that executes in the browser of a logged-in instructor or administrator who is tricked into opening a crafted link.