A critical reflected cross-site scripting vulnerability in the LearnPress WordPress plugin allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser.

This is a Cross-Site Scripting (CWE-79) vulnerability where the plugin fails to escape user-supplied values used in HTML attributes. An unauthenticated attacker can craft a malicious link that, when clicked by a logged-in administrator or user, executes arbitrary code within their session context.

The exploitation of this vulnerability allows attackers to hijack administrative sessions, steal sensitive session cookies, or redirect users to malicious sites. Given the CVSS score of 7.1, this flaw poses a high risk to the integrity and confidentiality of the WordPress environment, potentially leading to full site compromise if an administrator is targeted.

Immediate Action: Update the LearnPress WordPress plugin to version 4.4.7 or later immediately to apply the necessary input sanitization patches.

Proactive Monitoring: Review web server access logs for suspicious URL parameters containing script tags or abnormal encoded characters often associated with XSS payloads.

Compensating Controls: Deploy a Web Application Firewall (WAF) with active XSS protection rules to filter malicious payloads from incoming HTTP requests while the update is being staged.

Public Exploit Available: Unknown

Organizations utilizing the LearnPress plugin must prioritize this update to prevent potential account takeovers. Because this vulnerability facilitates cross-site scripting against administrative users, failure to patch could lead to total unauthorized control of the WordPress installation. Please verify your plugin version and apply the fix immediately.