CVE-2024-13599 is a stored cross-site scripting vulnerability in the LearnPress WordPress LMS plugin, affecting all versions up to and including 4.2.7.5. The issue arises from insufficient input sanitization and output escaping of lesson names, allowing authenticated users with LP Instructor-level access or above to inject arbitrary web scripts. These scripts execute in the context of other users viewing the injected pages, potentially leading to information disclosure or session hijacking. The vulnerability has a CVSS 3.1 base score of 6.4, indicating medium severity, with attack vector network, low attack complexity, and privileges required at the low level.

An attacker with authenticated LP Instructor-level access or higher can inject malicious scripts into lesson names that execute in the browsers of users who view those lessons. This can lead to the theft of user credentials, session tokens, or other sensitive information accessible via the browser context. The vulnerability does not impact availability but affects confidentiality and integrity to a limited extent.

No official patch or fix is currently referenced in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict LP Instructor-level access to trusted users only and consider applying web application firewall (WAF) rules to detect and block XSS payloads targeting the plugin. Monitor for updates from the vendor and apply official patches promptly once released.