Vulnerability · Published May 16, 2026 · Assigned by VulnCheck

CVE-2021-47975WordPress Plugin WP Learn Manager 1.1.2 Stored XSS

High 7.2

In plain English

A high-severity cross-site scripting in WP Learn Manager from Wplearnmanager. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)0.2%top 88.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

WP Learn Manager 1.1.2 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts through the `fieldtitle` parameter. Attackers can submit POST requests to the jslm_fieldordering page with XSS payloads in the fieldtitle field to execute arbitrary JavaScript when administrators view the field ordering interface.

Affected products (as reported)

Vendor	Product	Versions
Wplearnmanager	WP Learn Manager	1.1.2

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

References

ExploitDB-50086 exploit
Official Product Homepage product
Product Reference product
VulnCheck Advisory: WordPress Plugin WP Learn Manager 1.1.2 Stored XSS third-party-advisory