CVE-2022-0271

Deeper analysis

The LearnPress WordPress plugin before version 4.1.6 is affected by a reflected cross-site scripting vulnerability (CWE-79). The root cause is missing sanitization and escaping of the lp-dismiss-notice parameter when it is returned in the response of the lp_background_single_email AJAX action, allowing attacker-controlled content to be reflected into the page.

An unauthenticated remote attacker can exploit the flaw by inducing a victim to visit a crafted URL containing a malicious payload in the lp-dismiss-notice parameter. Successful exploitation results in execution of arbitrary JavaScript in the victim's browser within the context of the affected site, enabling theft of cookies, redirection, or other client-side actions. The reported CVSS 3.1 score of 6.1 reflects a network vector, low attack complexity, no required privileges, required user interaction, and changed scope with limited confidentiality and integrity impact.

The EPSS score reached a peak of 0.0539 but has since declined to 0.0416, indicating limited and non-persistent exploitation interest after disclosure.