Input validation vulnerability in Premium Courses & eLearning with Paid Memberships Pro for LearnDash, LifterLMS, Sensei LMS & TutorLMS 1.2.5

The Paid Memberships Pro – Courses for Membership Add On plugin for WordPress has a security vulnerability that affects multi-site installations and installations where unfiltered_html has been disabled. This vulnerability allows an authenticated attacker with administrator-level permissions or higher to inject malicious scripts into pages on the website. These scripts will be executed whenever someone accesses the injected page, which can have serious consequences. The vulnerability is present in versions up to and including 1.2.4 and is caused by insufficient input sanitization and output escaping. It can also be exploited via Cross-Site Request Forgery.