What’s Vulnerable › Vulnerabilities

CVE-2021-24504: WP LMS <= 1.1.2 - Stored Cross-Site Scripting (XSS)

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-08-02 · updated 2026-06-17
• Weakness: CWE-79

Description

The WP LMS – Best WordPress LMS Plugin WordPress plugin through 1.1.2 does not properly sanitise or validate its User Field Titles, allowing XSS payload to be used in them. Furthermore, no CSRF and capability checks were in place, allowing such attack to be performed either via CSRF or as any user (including unauthenticated)

Affected products

• WP LMS – Best WordPress LMS Plugin: through 1.1.2

References

• https://wpscan.com/vulnerability/e0182508-23f4-4bdb-a1ef-1d1be38f3ad1
• https://wpscan.com/vulnerability/e0182508-23f4-4bdb-a1ef-1d1be38f3ad1

Get alerted when CVE-2021-24504 or the next vulnerability affects your stack