CVE-2020-35650

https://notcve.org/view.php?id=CVE-2020-35650

23 Dec 2020 — Multiple cross-site scripting (XSS) vulnerabilities in Uncanny Groups for LearnDash before v3.7 allow authenticated remote attackers to inject arbitrary JavaScript or HTML via the ulgm_code_redeem POST Parameter in user-code-redemption.php, the ulgm_user_first POST Parameter in user-registration-form.php, the ulgm_user_last POST Parameter in user-registration-form.php, the ulgm_user_email POST Parameter in user-registration-form.php, the ulgm_code_registration POST Parameter in user-registration-form.php, t... • https://gist.github.com/michiiii/81d801f563138abe7da61e2d95342202 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •