CVE-2021-24504

6.1 mediumEPSS 0.8%

Medium (6.1) in wplearnmanager wp learn manager. EPSS 0.8% chance of exploitation in the next 30 days.

The WP LMS – Best WordPress LMS Plugin WordPress plugin through 1.1.2 does not properly sanitise or validate its User Field Titles, allowing XSS payload to be used in them. Furthermore, no CSRF and capability checks were in place, allowing such attack to be performed either via CSRF or as any user (including unauthenticated)

Severity

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 55% of CVEs (scores of 2026-10-31)
CWEs: CWE-79, CWE-352
Published: 2021-08-02
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

wplearnmanager:wp_learn_manager

References

https://wpscan.com/vulnerability/e0182508-23f4-4bdb-a1ef-1d1be38f3ad1
https://wpscan.com/vulnerability/e0182508-23f4-4bdb-a1ef-1d1be38f3ad1

Check your stack JSON