CVE-2021-47975
📛 CVE Title
(no title)
Description
WP Learn Manager 1.1.2 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts through the fieldtitle parameter. Attackers can submit POST requests to the jslm_fieldordering page with XSS payloads in the fieldtitle field to execute arbitrary JavaScript when administrators view the field ordering interface.
Overview
- State
- —
- Assigner (CNA)
- —
- CVSS severity
- high
- CVSS score
- 7.2 / 10
- CVSS vector
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N- Effective score
- 7.2 / 10 HIGH source: CNA overview
- CWE(s)
- —
- Reserved
- —
- Published
- —
- Last updated
- —
- Source
- https://www.tenable.com/cve/CVE-2021-47975
- Linked Threat
- CVE-2021-47975 — CVE-2021-47975
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2026-05-16 16:16:22 UTC
- NVD last modified
- 2026-05-18 17:32:04 UTC
- NVD CVSS v3.1
- 7.2 / 10 HIGH source: disclosure@vulncheck.com
- NVD CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N- Exploitability subscore
- 3.9 / 10
- Impact subscore
- 2.7 / 10
- EPSS score
- 0.0009 (probability of exploitation in next 30 days)
- EPSS percentile
- 25.32% vs all CVEs — higher = more likely to be exploited, as of 2026-05-24
NVD-assigned CWE(s):
CWE-79
(differs from the CNA list above)
NVD / KEV / EPSS data refreshed 2026-05-25 00:06 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2021-34830 - Assigner
- VulnCheck
- Published
- May 16, 2026, 3:26:15 PM
- Updated
- May 26, 2026, 11:51:44 AM
- EUVD base score (CVSS 4.0)
-
5.1 / 10
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - EUVD-reported EPSS
- 0.0900
- Vendors
- Wplearnmanager
- Products
-
WP Learn Manager (1.1.2)
- Aliases
-
GHSA-x5v4-ww8v-7jhc
ENISA description: WP Learn Manager 1.1.2 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts through the `fieldtitle` parameter. Attackers can submit POST requests to the jslm_fieldordering page with XSS payloads in the fieldtitle field to execute arbitrary JavaScript when administrators view the field ordering interface.
Vendor references (0)
References embedded in the original CVE record by the assigning CNA.
None in the CVE record.
Web references (7)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
- https://nvd.nist.gov/vuln/detail/CVE-2021-47975 tenable:nvd.nist.gov
- https://wordpress.org/plugins/learn-manager/ tenable:wordpress.org
- https://wplearnmanager.com/ tenable:wplearnmanager.com
- https://www.cve.org/CVERecord?id=CVE-2021-47975 tenable:www.cve.org
- https://www.exploit-db.com/exploits/50086 tenable:www.exploit-db.com
- https://www.first.org/epss/ tenable:www.first.org
- https://www.vulncheck.com/advisories/wordpress-plugin-wp-learn-manager-stored-xss tenable:www.vulncheck.com
NVD-tagged references (4)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
- https://wordpress.org/plugins/learn-manager/ disclosure@vulncheck.com
- https://wplearnmanager.com/ disclosure@vulncheck.com
- https://www.exploit-db.com/exploits/50086 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/wordpress-plugin-wp-learn-manager-stored-xss disclosure@vulncheck.com
Remediations (10)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
web:crimsondesert.pearlabyss.com
This patch adds game difficulty settings, new storage items, new pets, keyboard/mouse and controller preset options, new category tabs for the inventory, new skills, improvements to distant scenery quality, and more.
2026-05-26 02:55 UTC -
web:cybersecuritynews.com
Microsoft has disclosed a critical zero-day vulnerability in Windows BitLocker, tracked as CVE -2026-45585, that allows threat actors with physical access to bypass full-disk encryption entirely, potentially exposing sensitive data within minutes.
2026-05-26 02:55 UTC -
web:epatch.pa.gov
Why does PATCH exist? Its purpose is to better enable the public to obtain criminal history record checks. The repository was created and is maintained in accordance with Pennsylvania's Criminal History Information Act contained in Chapter 91 of Title 18, Crimes Code. This Act also directs the Pennsylvania State Police (PSP) to disseminate criminal history data to criminal justice agencies ...
2026-05-26 02:55 UTC -
web:feedly.com
Mitigation Update WP Learn Manager to a version newer than 1.1.2. Additionally, implement input validation and output encoding for the fieldtitle parameter to prevent XSS injection.
2026-05-26 02:55 UTC -
web:msrc.microsoft.com
Access Microsoft Security Response Center's guide to address vulnerabilities, manage security risks, and keep your systems protected with the latest updates.
2026-05-26 02:55 UTC -
web:patch.com
The best breaking news, stories, and events from the Patch network of local news sites
2026-05-26 02:55 UTC -
web:www.cve.org
At cve .org, we provide the authoritative reference method for publicly known information-security vulnerabilities and exposures
2026-05-26 02:55 UTC -
web:www.helpnetsecurity.com
Microsoft is working on a fix for CVE -2026-45585 (aka "Yellowkey"), a vulnerability that can be used to bypass Windows' BitLocker protection.
2026-05-26 02:55 UTC -
web:www.notebookcheck.net
Microsoft released mitigation steps for YellowKey ( CVE -2026-45585), a BitLocker bypass that grants physical attackers access to encrypted Windows drives.
2026-05-26 02:55 UTC -
web:www.thehackerwire.com
CVE-2021-47975 is a High severity vulnerability (CVSS 7.2). WP Learn Manager 1.1.2 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts through the...
2026-05-26 02:55 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.