CVE-2020-7108

The LearnDash LMS plugin before version 3.1.2 contains a reflected cross-site scripting vulnerability in the search functionality of the [ld_profile] shortcode. An attacker could exploit this flaw by injecting malicious scripts through the search field, which would execute in users' browsers when they visit a crafted link. LearnDash released version 3.1.2 on January 14, 2020, the same day the vulnerability was initially reported, to address this issue.

Based on public CVE data (MITRE/NVD).