This vulnerability arises from improper neutralization of input when generating web pages, allowing a DOM‑based cross‑site scripting attack that can inject arbitrary JavaScript into the victim browser. The attacker can execute code in the victim’s context, potentially accessing cookies, session data, or modifying page content, which may lead to data theft, session hijacking, or defacement.

The flaw affects the WP Courses LMS WordPress plugin by hookandhook, specifically all releases up to and including version 3.2.26. No other products or versions are identified as impacted.

The assessed severity is a medium CVSS score of 6.5, indicating significant risk to authenticated users who load the affected pages. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, suggesting it may not be actively exploited yet. The attack vector is client‑side; an attacker needs to entice a user to view a crafted URL or input on a site running the vulnerable plugin, after which malicious code runs in the user’s browser.