The plugin accepts arbitrary user input in review fields without proper neutralization and stores it for future rendering. The result is a stored cross‑site scripting flaw (CWE‑79) that can let an attacker inject and execute malicious JavaScript in the browsers of any visitor who views affected review pages, potentially enabling credential theft, session hijacking, or defacement.

The vulnerability affects the ThimPress LearnPress – Course Review WordPress plugin for all releases up through version 4.1.9. No more recent versions are covered by this description.

The CVSS base score of 6.5 indicates a medium severity issue, while the EPSS of less than 1% points to a low likelihood of exploitation at the time of analysis. The flaw resides in the browser context; an attacker only needs to submit a review containing malicious script, which will then run whenever other users view that review. The vulnerability is not currently listed in CISA’s KEV catalog and there is no advanced attack surface beyond the browser. Overall, the risk is moderate but the exploitation probability is relatively low.