PT-2025-38838 · Uncanny Owl · Uncanny Toolkit For Learndash

Zaim · Published 2025-09-22 · Updated 2025-09-22 · CVE-2025-57988

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Uncanny Owl Uncanny Toolkit for LearnDash versions through 3.0.7.3

Description The software contains a flaw related to improper input handling during web page generation, which allows for Stored Cross-site Scripting (XSS). This issue could potentially allow an attacker to inject malicious scripts into web pages viewed by other users. The vulnerability exists due to insufficient sanitization of user-supplied data before it is included in the generated web page content. The affected API endpoints and vulnerable parameters were not specified.

Recommendations Update Uncanny Owl Uncanny Toolkit for LearnDash to a version later than 3.0.7.3.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-57988

Affected Products

Uncanny Toolkit For Learndash

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-57988 · Security Note
• https://patchstack.com/database/Wordpress/Plugin/uncanny-learndash-toolkit/vulnerability/wordpress-uncanny-toolkit-for-learndash-plugin-3-0-7-3-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/1970255664237953429 · Twitter Post
• https://patchstack.com/database/wordpress/plugin/uncanny-learndash-toolkit/vulnerability/wordpress-uncanny-toolkit-for-learndash-plugin-3-0-7-3-cross-site-scripting-xss-vulnerability?_s_id=cve · Note