CVE-2021-47975
HighSummary
WP Learn Manager version 1.1.2 contains a stored XSS vulnerability that allows unauthenticated attackers to inject malicious scripts through the `fieldtitle` parameter. Attackers can submit POST requests to the jslm_fieldordering page with XSS payloads in the fieldtitle field, allowing arbitrary JavaScript execution when administrators view the field ordering interface.
Risk Assessment
This vulnerability poses a risk of executing malicious JavaScript code in the context of the administrator's browser, potentially leading to data theft or account takeover.
Recommendation
It is recommended to update WP Learn Manager to the latest version to mitigate this vulnerability and to monitor logs for potential attack attempts.
Original NVD description (English source)
WP Learn Manager 1.1.2 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts through the `fieldtitle` parameter. Attackers can submit POST requests to the jslm_fieldordering page with XSS payloads in the fieldtitle field to execute arbitrary JavaScript when administrators view the field ordering interface.