The vulnerability is an improper neutralization of input during web page generation in the ThimPress LearnPress plugin. It allows an attacker to inject malicious script code that is reflected back to the user’s browser when the page is rendered. A reflected XSS flaw can enable session hijacking, credential theft, defacement, or arbitrary script execution in the context of the logged‑in user, posing a moderate to high confidentiality and integrity risk.

WordPress sites running the ThimPress LearnPress plugin in any version from the earliest released version up through 4.3.6 are affected. The issue does not impact versions 4.3.7 and newer.

The CVSS score of 7.1 indicates medium severity, and no EPSS score is available, suggesting the exploit probability is unknown. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to deliver a crafted request that includes malicious input, which is then reflected by the plugin. Victim interaction is typically needed for the browser to execute the injected script, making the attack vector web‑based and potentially user‑arbitrary. The absence of a KEV listing does not guarantee low risk, as web‑based XSS flaws are commonly exploited in the wild.