The LearnPress Export Import extension for WordPress contains a reflected XSS vulnerability due to improper neutralization of input in the 'learnpress_import_form_server' parameter. This allows unauthenticated attackers to inject and execute arbitrary web scripts in the context of a victim's browser if the victim interacts with a maliciously crafted link. The issue affects all versions up to 4.0.4. The vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and impacts confidentiality and integrity with no availability impact. No patch or official fix has been documented in the provided data.

Successful exploitation can lead to execution of arbitrary scripts in the context of a victim's browser, potentially allowing theft of sensitive information or session tokens, and manipulation of web content. The impact is limited to confidentiality and integrity with no direct availability impact. The vulnerability requires user interaction and can be triggered by an unauthenticated attacker via a crafted link.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with links related to the LearnPress Export Import functionality and consider disabling or restricting access to the vulnerable extension if possible. Monitor vendor channels for updates and apply patches promptly once released.