CVE-2021-24504 describes a Cross-Site Scripting (XSS) vulnerability in the WP LMS – Best WordPress LMS Plugin up to version 1.1.2. This flaw allows attackers to inject malicious scripts into User Field Titles due to insufficient input sanitization and validation. The vulnerability is rated Medium severity (CVSS 6.1) and can be exploited remotely with low complexity, potentially affecting confidentiality and integrity. While no active exploitation or public exploit code has been identified, and community discussion is minimal, the absence of CSRF and capability checks means even unauthenticated users could trigger the XSS.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.1.2CPE matchmatch criteria | cpe:2.3:a:wplearnmanager:wp_learn_manager:*:*:*:*:*:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.