CVE-2021-24504: The WP LMS – Best WordPress LMS Plugin WordPress plugin through 1.1.2 does not properly sanitise or validate i

Q: How do I fix CVE-2021-24504?

wp learn manager: upgrade to newer than 1.1.2. Exact commands for each OS are on this page.

Q: Is CVE-2021-24504 being exploited?

CVE-2021-24504 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2021-24504 affect?

CVE-2021-24504 affects wp learn manager. Severity is medium (CVSS 6.1). The WP LMS – Best WordPress LMS Plugin WordPress plugin through 1.1.2 does not properly sanitise or validate its User Field Titles, allowing XSS payload to be used in them. Furthermore, no CSRF and capability checks were in place, allowing

Q: How urgent is CVE-2021-24504?

Priority 40/100. Public exploit reference

This month

MEDIUM 6.1UPGRADE

CVE-2021-24504 is a medium-severity flaw (CVSS 6.1) affecting wp learn manager. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

The WP LMS – Best WordPress LMS Plugin WordPress plugin through 1.1.2 does not properly sanitise or validate its User Field Titles, allowing XSS payload to be used in them. Furthermore, no CSRF and capability checks were in place, allowing such attack to be performed either via CSRF or as any user (including unauthenticated)

Why this priority

Public exploit reference

A fixed release or distro patch exists.

Risk facts

CVSS score	6.1 (Medium)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	Required
EPSS exploit chance	0.8% (top 45%)
CISA exploited list	No
Weakness	CWE-79, CWE-352
Published	2021-08-02
Last modified	2026-06-17

Publisher (CNA): WPScan · Vendor: wplearnmanager

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2021-08-02 11:15 UTCPublished CVE record published
2026-06-17 03:40 UTCUpdated Record last modified

wplearnmanager wp learn manager UPGRADE

Affected: <= 1.1.2

Fixed in: newer than 1.1.2

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy wp-learn-manager || rpm -q wp-learn-manager || wp-learn-manager --version

2. UPGRADE to newer than 1.1.2 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade wp-learn-manager

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade wp-learn-manager

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2021-24504?

wp learn manager: upgrade to newer than 1.1.2. Exact commands for each OS are on this page.

Is CVE-2021-24504 being exploited?

CVE-2021-24504 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2021-24504 affect?

CVE-2021-24504 affects wp learn manager. Severity is medium (CVSS 6.1). The WP LMS – Best WordPress LMS Plugin WordPress plugin through 1.1.2 does not properly sanitise or validate its User Field Titles, allowing XSS payload to be used in them. Furthermore, no CSRF and capability checks were in place, allowing

How urgent is CVE-2021-24504?

Priority 40/100. Public exploit reference

Software pages

WordPress vulnerabilities

References

← Back to latest CVEs