LearnPress Vulnerability – Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter – CVE-2024-4971 | WordPress Plugin Vulnerability Report

Plugin Name: LearnPress

Key Information:

  • Software Type: Plugin
  • Software Slug: learnpress
  • Software Status: Active
  • Software Author: thimpress
  • Software Downloads: 4,287,642
  • Active Installs: 90,000
  • Last Updated: May 21, 2024
  • Patched Versions:
  • Affected Versions: <=

Vulnerability Details:

  • Name: LearnPress – WordPress LMS Plugin <= - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
  • Type: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
  • CVE: CVE-2024-4971
  • CVSS Score: 6.4 (Medium)
  • Publicly Published: May 21, 2024
  • Researcher: stealthcopter
  • Description: The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in all versions up to, and including, due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.


The LearnPress plugin for WordPress has a vulnerability in versions up to and including that allows unauthenticated attackers to inject arbitrary web scripts via the 'id' parameter due to insufficient input sanitization and output escaping. This vulnerability has been patched in version

Detailed Overview:

The vulnerability, discovered by researcher stealthcopter, is a Reflected Cross-Site Scripting (XSS) issue that arises from the improper handling of the 'id' parameter. Attackers can craft malicious links containing scripts that, when clicked by a user, execute in the context of the website. This could potentially lead to the theft of sensitive information or unauthorized actions on behalf of the user. The vulnerability is present in all versions of the plugin up to and including

Advice for Users:

  1. Immediate Action: Update the LearnPress plugin to version or later immediately.
  2. Check for Signs of Vulnerability: Review your site for any suspicious activity or unauthorized changes.
  3. Alternate Plugins: While a patch is available, users might still consider plugins that offer similar functionality as a precaution.
  4. Stay Updated: Always ensure that your plugins are updated to the latest versions to avoid vulnerabilities.

The prompt response from the LearnPress developers to patch this vulnerability underscores the importance of timely updates. Users are advised to ensure that they are running version or later to secure their WordPress installations.




Detailed Report:

As a website owner, keeping your site secure should always be a top priority. However, even with the best intentions, vulnerabilities can slip through the cracks, leaving your site exposed to potential threats. A recent discovery by security researchers has uncovered a critical vulnerability in the popular LearnPress plugin for WordPress, potentially putting thousands of websites at risk.

In this blog post, we'll dive into the details of this vulnerability, the risks it poses, and most importantly, what you can do to protect your website. We'll also discuss the importance of keeping your WordPress plugins up to date and offer our assistance to anyone who may be concerned about their website's security.

The LearnPress Plugin

LearnPress is a popular WordPress plugin that transforms your website into a full-featured Learning Management System (LMS). With over 90,000 active installations and more than 4 million downloads, it's a widely-used solution for creating online courses and educational content.

The Vulnerability: CVE-2024-4971

The vulnerability, identified as CVE-2024-4971, is a Reflected Cross-Site Scripting (XSS) issue that affects all versions of the LearnPress plugin up to and including The flaw arises from insufficient input sanitization and output escaping of the 'id' parameter, allowing unauthenticated attackers to inject arbitrary web scripts into pages that execute when a user clicks on a maliciously crafted link.

Risks and Potential Impacts

Cross-Site Scripting vulnerabilities are among the most common and dangerous web application flaws. They allow attackers to bypass security measures and gain unauthorized access to sensitive data, such as user credentials or financial information. In some cases, attackers may even use XSS to perform actions on behalf of the user, such as making unauthorized purchases or posting content without their knowledge.

With the LearnPress vulnerability, an attacker could potentially steal sensitive information from your website's users or perform unauthorized actions, putting your site's reputation and your users' data at risk.

How to Fix the Vulnerability

To address this vulnerability, the LearnPress developers have released a patched version, If you're using the LearnPress plugin, we strongly recommend updating to this version or later immediately. This will ensure that your site is protected against potential attacks.

To update your plugin:

  1. Log in to your WordPress admin dashboard.
  2. Navigate to "Plugins" and locate the LearnPress plugin.
  3. Click on "Update Now" to install the latest patched version.

After updating, it's crucial to review your site for any suspicious activity or unauthorized changes that may have occurred prior to the update.

Previous LearnPress Vulnerabilities

It's worth noting that the LearnPress plugin has had a history of security issues. Since November 2018, there have been 35 reported vulnerabilities in the plugin. This underscores the importance of regularly updating your plugins and staying informed about potential security risks.

The Importance of Staying Vigilant

As a small business owner, it's understandable that you may not have the time or resources to constantly monitor your website for security vulnerabilities. However, the potential consequences of a security breach – such as data theft, loss of customer trust, and financial damage – make it essential to prioritize website security.

By keeping your WordPress plugins updated, regularly monitoring your site for suspicious activity, and working with trusted security professionals when needed, you can significantly reduce the risk of falling victim to a vulnerability like the one found in LearnPress.

If you're concerned about the security of your WordPress site or need assistance with updating your plugins, don't hesitate to reach out to a professional web development or security company. They can help you navigate the complex world of website security and provide the peace of mind that comes with knowing your site is protected.

As a business owner, you don't have time to constantly monitor for WordPress vulnerabilities like this. At Your WP Guy, we become your outsourced IT team to handle security, updates, maintenance and support. Let us fully audit your site and plugins to assess any impact from this issue. We'll update everything to patched versions so you can rest easy knowing your site is locked down.

Focus on your business goals while we focus on your WordPress site's security. Chat with us anytime during business hours, schedule a call or call 678-995-5169 for a free consultation on securing your online presence.

LearnPress Vulnerability – Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter – CVE-2024-4971 | WordPress Plugin Vulnerability Report FAQs

Leave a Comment