Description
LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role can submit unsanitized payloads through the update_question AJAX handler that execute in the session of every student taking the quiz.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ThimPress | LearnPress | ≤ 4.4.9.1 | — |
References
- Patch Commit patch
- Unsanitized hint/explanation write (4.4.9.1) technical-description
- dangerouslySetInnerHTML render sink (4.4.9.1) technical-description
- https://wordpress.org/plugins/learnpress/ product
- VulnCheck Advisory: LearnPress WordPress Plugin through 4.4.9.1 Stored XSS via Quiz Question Hint and Explanation third-party-advisory