The LearnPress – Course Review plugin contains a stored DOM‑based XSS vulnerability caused by insufficient sanitization of the review_title parameter. When a user submits a review, the title is saved without filtering and later rendered inside the page. An authenticated attacker with subscriber level or higher can embed JavaScript; the payload is only executed once the review is approved by an administrator or if the site is set to auto‑approve reviews.

WordPress sites using thimpress LearnPress – Course Review version 4.2.2 or any earlier release. The flaw applies to all releases up to and including 4.2.2 and affects sites that allow subscriber‑level users to submit reviews.

With a CVSS score of 6.4 the vulnerability is of moderate severity and is not listed in the CISA KEV catalog. The EPSS score is not available. The attack vector requires authentication; an attacker must first log in with subscriber or higher privileges, submit a malicious review, and wait for an administrator to approve it (or rely on auto‑approval). Execution occurs when any user loads the review page, potentially allowing cookie theft, session hijacking, or defacement of the site.