CVE-2024-1463 describes a stored Cross-Site Scripting vulnerability in the LearnPress WordPress LMS Plugin for creating and selling online courses. The issue arises from improper neutralization of input during web page generation (CWE-79), specifically in course, lesson, and quiz titles and content fields. Authenticated attackers with LP Instructor-level access can inject arbitrary scripts that execute in the context of users viewing the injected pages. This vulnerability affects all versions up to and including 4.2.6.3. The CVSS 3.1 vector indicates network attack vector, high attack complexity, high privileges required, no user interaction, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

An attacker with authenticated instructor-level access can inject malicious scripts into course-related content, which execute when other users access those pages. This can lead to limited confidentiality and integrity impacts, such as session hijacking or unauthorized actions performed in the context of affected users. There is no indication of availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict instructor-level access to trusted users only and consider applying web application firewall (WAF) rules to detect and block suspicious script injections in course content fields.