The LifePress plugin for WordPress is vulnerable to a stored cross‑site scripting flaw originating from the unvalidated 'n' parameter received by the lp_update_mds AJAX action. Because the action is registered without a nonce check or capability verification and the input is not sanitized or escaped before being displayed, an unauthenticated attacker can store arbitrary JavaScript in the database. When any administrator or user loads the affected admin page, the injected script runs in that user's browser, potentially leading to session hijacking, defacement, or credential theft.

WordPress installations running the LifePress plugin version 2.2.2 or earlier. The vulnerability applies to all releases up to and including 2.2.2 from the vendor ashanjay.

The vulnerability receives a CVSS score of 7.2, indicating a high severity. The EPSS score is not available, but the lack of authentication requirements means that any visitor can exploit the flaw, raising the likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can target the vulnerable AJAX endpoint with crafted requests, inject malicious payloads, and cause client‑side script execution for all users who access the page.