Stored XSS in LearnPress WordPress Plugin

Executive Summary

The LearnPress plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 4.4.0. This occurs because the 'class_wrapper_form' shortcode attribute is not properly sanitized or escaped before being inserted into an HTML class attribute. Specifically, the FilterCourseTemplate::sections() method inserts this attribute using sprintf without applying esc_attr() escaping. Additionally, the FilterCourseShortcode::render() handler does not filter shortcode attributes, allowing raw user input to flow directly into the template. As a result, authenticated users with contributor-level access or higher can inject malicious scripts that execute whenever a user views the affected page.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with contributor-level access or higher to inject arbitrary malicious scripts into pages. These scripts execute in the context of users who visit the infected pages, potentially leading to theft of sensitive information, session hijacking, defacement, or further exploitation of the website. Since the vulnerability is a stored XSS, the malicious code persists on the site and affects all users who access the compromised content.

Useful 0 Not Useful 0