A Stored Cross-Site Scripting vulnerability in the WP Learn Manager WordPress plugin allows authenticated attackers to inject malicious scripts into web pages.

This is a CWE-79 Stored XSS vulnerability. The flaw allows an attacker with low-level privileges to inject malicious payloads that execute in the context of other users' sessions.

Successful exploitation of this XSS vulnerability could lead to session hijacking, unauthorized actions performed on behalf of legitimate users, or the redirection of visitors to malicious sites. While the CVSS score of 7.2 reflects a significant risk, the impact is primarily focused on client-side integrity and user session security rather than server-side compromise.

Immediate Action: As no specific patched version is currently identified, verify if a security update has been released by the vendor; if not, disable the plugin until a fix is verified.

Proactive Monitoring: Monitor site traffic for unusual script injections in user-managed content fields or unexpected redirect patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with robust XSS filtering rules to block known attack patterns targeting this plugin.

Public Exploit Available: Yes — an entry exists on ExploitDB (50086).

Given the availability of a public exploit and the ease of exploitation, this vulnerability poses a credible threat to site integrity. Administrators should prioritize identifying instances of this plugin and either apply vendor-supplied patches or remove the component to eliminate the attack surface entirely.