Improper neutralization of input during web page generation allows stored XSS. An attacker who can inject malicious script into the plugin’s data store can execute arbitrary code in the browsers of any user who views the affected page, potentially leading to session hijacking, data theft or site defacement. This weakness is identified as CWE‑79.

WordPress sites that have installed Uncanny Owl’s Uncanny Toolkit for LearnDash plugin version 3.7.0.3 or earlier are affected. The vulnerability applies to the plugin as it operates within the WordPress environment, affecting any site that has loaded the plugin without an upgrade.

The CVSS score of 6.5 reflects medium severity. The EPSS score is below 1 %, indicating a very low but non‑zero likelihood of exploitation. The issue is not listed in CISA’s KEV catalog. Exploitation would typically occur via the plugin’s input fields that store data in the database, and requires the attacker to inject harmful script content that later renders when any user view the stored data. The combination of moderate severity and low exploitation probability suggests a moderate overall risk for sites that remain on vulnerable plugin versions.