PT-2026-41461 · Wplearnmanager · Wp Learn Manager

Mohammed Adam · Published 2026-05-16 · Updated 2026-05-16 · CVE-2021-47975

Mitre

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

WP Learn Manager 1.1.2 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts through the fieldtitle parameter. Attackers can submit POST requests to the jslm fieldordering page with XSS payloads in the fieldtitle field to execute arbitrary JavaScript when administrators view the field ordering interface.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-47975

Affected Products

Wp Learn Manager

References · 5

• 🔥 https://exploit-db.com/exploits/50086 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-47975 · Security Note
• https://wordpress.org/plugins/learn-manager · Note
• https://wplearnmanager.com · Note
• https://vulncheck.com/advisories/wordpress-plugin-wp-learn-manager-stored-xss · Note