The LearnPress Export Import plugin fails to properly neutralize user input when it is embedded in a generated web page, which permits a reflected cross‑site scripting (XSS) flaw. If successfully exploited, the flaw can cause malicious JavaScript to run in the victim’s browser context.

WordPress sites that use the ThimPress LearnPress Export Import plugin version 4.0.9 or earlier are affected. Site administrators should consider whether these versions are deployed when planning remediation.

The CVSS score of 7.1 classifies the vulnerability as high severity, yet the EPSS score of less than 1% indicates a current low likelihood of exploitation. The issue is not listed in the CISA KEV catalog. Based on the nature of the flaw, an attacker would probably need to entice a user to visit a maliciously crafted URL; such social‑engineering tactics are common, so the risk for publicly exposed sites remains reasonable.