CVE-2021-47975: WP Learn Manager Stored XSS Vulnerability

CVE-2021-47975 Overview

CVE-2021-47975 is a stored cross-site scripting (XSS) vulnerability in WP Learn Manager version 1.1.2, a WordPress plugin. The flaw resides in the fieldtitle parameter handled by the jslm_fieldordering page. Attackers can submit a crafted POST request containing JavaScript payloads in the fieldtitle field. The injected script is stored and later executed in the browser of any administrator who loads the field ordering interface. The vulnerability is classified under [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact
Stored JavaScript executes in administrator browser sessions, enabling session theft, account takeover, and unauthorized actions within the WordPress dashboard.

Affected Products

WP Learn Manager plugin for WordPress, version 1.1.2
WordPress sites with the Learn Manager plugin enabled
Administrators using the jslm_fieldordering interface

Discovery Timeline

2026-05-16 - CVE-2021-47975 published to NVD
2026-05-18 - Last updated in NVD database

Technical Details for CVE-2021-47975

Vulnerability Analysis

The vulnerability is a stored XSS issue in WP Learn Manager 1.1.2. The plugin accepts user-supplied values for the fieldtitle parameter without applying output encoding or input sanitization. When an attacker submits a POST request to the jslm_fieldordering endpoint with HTML or JavaScript in the fieldtitle field, the payload is persisted in the plugin's data store.

When an administrator subsequently views the field ordering interface, the malicious payload is rendered inline and executed by the browser. The attacker context is unauthenticated, while the victim context is a privileged WordPress administrator. This combination raises the impact above a typical reflected XSS.

References include the VulnCheck Advisory on WP Learn Manager and the public Exploit-DB entry #50086.

Root Cause

The root cause is missing input validation and missing output escaping for the fieldtitle parameter. The plugin does not call WordPress sanitization helpers such as sanitize_text_field() on write, nor esc_html() or esc_attr() on render. As a result, arbitrary markup is preserved and executed within the administrator's authenticated session.

Attack Vector

The attack vector is network-based and requires user interaction by an administrator who visits the field ordering interface. An attacker sends a POST request to the jslm_fieldordering page with a JavaScript payload in fieldtitle. Once stored, the payload triggers on every administrator view of the affected screen, allowing cookie theft, CSRF token harvesting, or actions executed as the administrator.

The vulnerability mechanism is described in the referenced advisories. No verified proof-of-concept code is reproduced here.

Detection Methods for CVE-2021-47975

Indicators of Compromise

POST requests to URLs containing jslm_fieldordering with <script>, onerror=, onload=, or javascript: substrings in the fieldtitle parameter.
Unexpected HTML or JavaScript fragments rendered in the WP Learn Manager field ordering admin page.
Outbound requests from administrator browsers to unknown domains shortly after loading the plugin admin interface.

Detection Strategies

Inspect web server access logs for POST requests targeting jslm_fieldordering with encoded or raw script payloads in fieldtitle.
Query the WordPress database for stored values in Learn Manager tables containing <script, onerror, or other event handler keywords.
Use a web application firewall to flag XSS signatures on requests reaching WordPress admin endpoints.

Monitoring Recommendations

Monitor administrator session activity for anomalous actions following visits to plugin configuration pages.
Alert on creation of new administrator accounts or modifications to user roles immediately after admin dashboard access.
Log and review all POST traffic to /wp-admin/ pages associated with the Learn Manager plugin.

How to Mitigate CVE-2021-47975

Immediate Actions Required

Disable or uninstall the WP Learn Manager plugin until a patched version is confirmed available.
Audit Learn Manager database records for previously stored payloads containing script tags or event handlers, and purge malicious entries.
Rotate WordPress administrator credentials and invalidate active sessions if the plugin has been in use.

Patch Information

No vendor-supplied patch is referenced in the available advisories. Site operators should check the WordPress Plugin Learn Manager page and the WP Learn Manager vendor site for updates beyond version 1.1.2. If no fixed release is available, removal of the plugin is the safest action.

Workarounds

Restrict access to /wp-admin/ to trusted IP addresses using web server or firewall rules.
Deploy a web application firewall rule that blocks script tags and JavaScript event handlers in POST parameters reaching jslm_fieldordering.
Apply a Content Security Policy that disallows inline script execution in the WordPress admin context to limit XSS impact.

bash

# Example nginx rule to block script payloads targeting the vulnerable endpoint
location ~* /wp-admin/.*jslm_fieldordering {
    if ($request_method = POST) {
        if ($request_body ~* "(<script|onerror=|onload=|javascript:)") {
            return 403;
        }
    }
}