A stored cross‑site scripting flaw in the Uncanny Toolkit for LearnDash plugin allows an attacker to inject malicious JavaScript that is permanently rendered when users view affected content. This can lead to session hijacking, defacement, or redirection of site visitors, compromising user confidentiality and integrity.

WordPress sites running the Uncanny Owl Uncanny Toolkit for LearnDash plugin on version 3.7.0.1 or earlier. The vulnerability exists in all releases from the initial public version through to 3.7.0.1.

The CVSS score of 6.5 indicates a moderate severity, while the EPSS score of less than 1% reflects a low probability of exploitation as of the data available. The flaw is not listed in the CISA KEV catalog, suggesting no publicly known exploits at present. A likely attack vector involves an authenticated user with permissions to edit plugin content, who can insert malicious code that is later rendered for all site visitors. Despite the low exploitation probability, the potential impact warrants timely remediation.