The vulnerability allows an unauthenticated attacker to inject arbitrary JavaScript into the LearnPress plugin via improperly sanitized input fields, resulting in a reflected or stored cross‑site scripting flaw (CWE‑79). If an attacker successfully injects malicious code, it will execute in the context of the victim’s browser or the site administrator’s session, potentially enabling cookie theft, session hijacking, or defacement of the WordPress site. The impact is limited to confidentiality, integrity, and availability of the web user interface.

The affected vendor is ThimPress with its LearnPress plugin. Versions up to and including 4.4.9 are vulnerable, and at least 4.4.9.1 has been released to fix this flaw. All WordPress installations that have learned‑press plugin versions 4.4.9 or earlier should be treated as at risk.

The CVSS score of 7.1 indicates a high severity vulnerability. EPSS score of 0.18% and the flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is through crafted URLs or form submissions that include malicious script payloads, which can be triggered by any site visitor. Because no authentication is required, the flaw is readily exploitable, potentially leading to significant compromise of user sessions or site integrity.