The LearnPress Export Import – WordPress extension for LearnPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'learnpress_import_form_server' parameter in all versions up to, and including, 4.0.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
History

Tue, 19 Nov 2024 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Thimpress
Thimpress learnpress Export Import
CPEs cpe:2.3:a:thimpress:learnpress_export_import:*:*:*:*:*:wordpress:*:*
Vendors & Products Thimpress
Thimpress learnpress Export Import

Fri, 15 Nov 2024 18:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Fri, 15 Nov 2024 04:45:00 +0000

Type Values Removed Values Added
Description The LearnPress Export Import – WordPress extension for LearnPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'learnpress_import_form_server' parameter in all versions up to, and including, 4.0.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Title LearnPress Export Import – WordPress extension for LearnPress <= 4.0.4 - Reflected Cross-Site Scripting
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}


cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published: 2024-11-15T04:29:05.635Z

Updated: 2024-11-15T18:10:39.859Z

Reserved: 2024-10-07T21:55:41.694Z

Link: CVE-2024-9609

cve-icon Vulnrichment

Updated: 2024-11-15T18:10:32.368Z

cve-icon NVD

Status : Analyzed

Published: 2024-11-15T05:15:06.373

Modified: 2024-11-19T21:28:42.670

Link: CVE-2024-9609

cve-icon Redhat

No data.