Improper neutralization of input during web page generation in ThimPress LearnPress – Course Review plugin allows stored cross‑site scripting. Review text is stored without sanitization, so an attacker can submit a review containing malicious JavaScript that will execute in the browsers of any visitor who views the review. This client‑side code injection can lead to credential theft, session hijacking, or defacement. The vulnerability is classified as CWE‑79 and affects all releases through version 4.1.9.

The vulnerability affects the ThimPress LearnPress – Course Review WordPress plugin for all releases up through version 4.1.9. No more recent versions are covered by this description.

The CVSS base score of 6.5 indicates a medium severity issue, while the EPSS of less than 1% points to a low likelihood of exploitation at the time of analysis. The flaw resides in the browser context; an attacker only needs to submit a review containing malicious script, which will then run whenever other users view that review. The vulnerability is not currently listed in CISA’s KEV catalog and there is no advanced attack surface beyond the browser. Overall, the risk is moderate but the exploitation probability is relatively low.