Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.1

LearnPress Export Import Extension for WordPress Allows Malicious Scripts to Run

CVE-2024-9609 · published 1 year ago
Summary

The LearnPress Export Import extension for WordPress plugins allows attackers to inject malicious code into websites by tricking users into clicking on a link. This can happen to any version of the extension up to 4.0.4. To fix this, update the extension to a version higher than 4.0.4 or remove it until a fix is available.

What to do
  • Update thimpress learnpress_export_import to version 4.0.5 or later.
Affected software
VendorProductAffected versions
thimpress learnpress_export_import < 4.0.5
cpe:2.3:a:thimpress:learnpress_export_import:*:*:*:*:*:wordpress:*:*
Original advisory text
The LearnPress Export Import – WordPress extension for LearnPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'learnpress_import_form_server' parameter in all versi...
The LearnPress Export Import – WordPress extension for LearnPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'learnpress_import_form_server' parameter in all versions up to, and including, 4.0.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.1 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published15 Nov 2024
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2024-9609 · NVD
Track software like this
Free during beta