CVE-2023-5558

MEDIUMNuclei

LearnPress < 4.2.5.5 - Reflected Cross-Site Scripting

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2023-5558 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The LearnPress WordPress plugin before 4.2.5.5 does not sanitise and escape user input before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 23, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

LearnPress

Default status: unaffected

CVE ListBefore 4.2.5.5affected

Nuclei templates

1
ProjectDiscoveryMEDIUMLearnPress < 4.2.5.5 - Cross-Site ScriptingCVSS 6.1

The LearnPress WordPress plugin before 4.2.5.5 does not sanitise and escape user input before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

Impact

Allows attackers to execute malicious scripts in the context of the victim's browser.

Remediation

Update LearnPress WordPress Plugin to the latest version to mitigate the vulnerability.

WeaknessesCWE-79
Authorsritikchaddha
Template tagscvecve2023wpwp-pluginwordpresslearnpressxssauthenticatedvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:thimpress:learnpress:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/4efd2a4d-89bd-472f-ba5a-f9944fd4dd16/ https://nvd.nist.gov/vuln/detail/CVE-2023-5558

Source: ProjectDiscovery

References

2