An improper neutralization of input during page rendering in teachPress allows attackers to inject and persist malicious scripts. The defect is a stored cross‑site scripting vulnerability, which could enable an attacker to execute arbitrary JavaScript in the browsers of any user that visits the affected page. Once executed, the script may steal session cookies, hijack user accounts, or deface the site.

The flaw exists in the teachPress plugin for WordPress, version 9.0.12 and older, developed by winkm89. All releases from the earliest version through 9.0.12 are vulnerable; versions 9.0.13 and later contain the fix.

With a CVSS score of 6.5, the vulnerability is considered moderate in severity. The EPSS score indicates a very low probability of exploitation at this time, and the issue is not catalogued in CISA’s KEV list. Attackers would need to access a writeable form or data entry point within the plugin to inject payloads, after which the payload is stored and served to all users viewing the affected content.