CyberRota Analysis
AI-GeneratedThe LearnPress WordPress plugin prior to version 4.4.7 is vulnerable due to improper escaping of user-supplied values in HTML attributes, enabling unauthenticated attackers to inject and execute arbitrary JavaScript in the browsers of users who visit a crafted link. This poses a significant risk, particularly to sites using a classic theme, as it could lead to session hijacking or other malicious actions affecting both regular users and logged-in administrators. WordPress site administrators, especially those using the affected plugin, should prioritize updating to the latest version to mitigate this vulnerability.
Original NVD Description
The LearnPress WordPress plugin before 4.4.7 does not escape a user supplied value before using it in an HTML attribute on a public page, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of anyone who opens a crafted link, including a logged in administrator. Only sites running a classic, non-block are affected.