WP Learn Manager 1.1.2 includes a stored cross‑site scripting weakness that allows an unauthenticated attacker to inject arbitrary JavaScript via the fieldtitle parameter. By sending a crafted POST request to the jslm_fieldordering endpoint, an attacker can place malicious payloads that are executed when an administrator subsequently opens the field ordering interface. Because the payload runs in the admin’s browser context, it could steal administrative credentials, hijack sessions, or perform further malicious actions on the site.

Vulnerabilities are present only in the WordPress plugin WP Learn Manager, version 1.1.2. Based on the vendor's documentation, it is inferred that earlier releases (1.0.0 to 1.1.1) and later releases (1.1.3 and above) are not affected. Therefore, sites running the exact 1.1.2 build are at risk.

The flaw carries a CVSS score of 5.1, indicating moderate severity, and no EPSS data is currently available. The exploitation path is remote and requires no authentication, which increases the risk of exploitation by a wide range of attackers. Because the vulnerability is not listed in CISA’s KEV catalog, no known widespread exploitation campaigns have been reported, but the attack vector remains straightforward: unauthenticated POST to the ordering page followed by an admin’s visit to the interface triggers client‑side script execution.