LearnPress WordPress Plugin Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in the LearnPress WordPress plugin, affecting versions prior to 4.4.1. The issue arises because the plugin fails to properly escape a search parameter before reflecting it into an HTML attribute. This flaw allows an attacker to execute malicious scripts in the browser of a logged-in instructor or administrator who is deceived into clicking a crafted link.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Remediation

Users are advised to update the LearnPress WordPress plugin to version 4.4.1 or later.