CVE-2022-0271

MEDIUM NUCLEI

LearnPress < 4.1.6 - Reflected Cross-Site Scripting via lp-dismiss-notice Parameter

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2022-0271 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

Description

The LearnPress WordPress plugin before 4.1.6 does not sanitise and escape the lp-dismiss-notice before outputting it back via the lp_background_single_email AJAX action, leading to a Reflected Cross-Site Scripting

Nuclei Templates (1)

LearnPress <4.1.6 - Cross-Site Scripting
MEDIUMby Akincibor
Shodan: http.html:/wp-content/plugins/learnpress
FOFA: body=/wp-content/plugins/learnpress

References (1)

Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://wpscan.com/vulnerability/ad07d9cd-8a75-4f7c-bbbe-3b6b89b699f2

Scores

CVSS v3 6.1
EPSS 0.0221
EPSS Percentile 80.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (1)
thimpress/learnpress < 4.1.6
Published Apr 11, 2022
Tracked Since Feb 18, 2026