The Uncanny Owl Uncanny Toolkit for LearnDash plugin suffers from a stored cross-site scripting vulnerability due to improper input neutralization during web page generation. This flaw affects all versions up to 3.7.0.3. An attacker with low privileges and requiring user interaction could exploit this vulnerability to execute arbitrary scripts, potentially impacting confidentiality, integrity, and availability of the affected system. The CVSS v3.1 base score is 6.5, reflecting medium severity with network attack vector, low attack complexity, and partial impact on confidentiality, integrity, and availability. No patch or official remediation guidance is currently provided.

Successful exploitation of this stored XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of users who view the affected web pages. This may lead to partial compromise of confidentiality, integrity, and availability of the affected LearnDash environment. However, exploitation requires low privileges and user interaction. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting user input to trusted users only and applying web application firewall (WAF) rules to detect and block XSS payloads where feasible. Monitor vendor channels for updates and apply patches promptly once released.