CVE-2024-9881

Summary

CVE-2024-9881 is a newly disclosed vulnerability affecting the LearnPress WordPress plugin before version 4.2.7.2. This issue stems from insufficient sanitization and escaping of certain settings, making it susceptible to Stored Cross-Site Scripting (XSS) attacks. High privilege users, including admins, can leverage this vulnerability to inject malicious code, even when the unfiltered_html capability is disallowed, posing a significant risk in multisite setups.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.