CVE-2024-3560

CVE-2024-3560 describes a Stored Cross-Site Scripting (XSS) vulnerability in the LearnPress – WordPress LMS Plugin, affecting all versions up to and including 4.2.6.4. This flaw, stemming from insufficient input sanitization and output escaping, allows authenticated attackers with contributor-level access or higher to inject malicious web scripts into pages. When a user accesses an affected page, these scripts execute, potentially leading to information disclosure or unauthorized actions. The vulnerability carries a CVSS score of 5.4 (Medium), indicating a network-based attack with low complexity and requiring user interaction, resulting in low impact on confidentiality and integrity. While the EPSS score is very low, suggesting minimal exploitability in the wild, the FAUCET Risk Score is 21/100, indicating a moderate risk. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. The vulnerability has garnered no community discussion or media coverage, suggesting a low level of public awareness and attention.