LearnPress CVE-2026-104670

Exploitation requires that an attacker trick a user into interacting with attacker-controlled input (UI:R in the vector) - typically clicking a crafted URL or viewing injected content processed by LearnPress ≤4.4.9 - so this is not a zero-click flaw. No authentication is needed to deliver the payload (PR:N), making any publicly reachable site running a vulnerable LearnPress version a candidate target in its default state. The input does not name the exact vulnerable parameter, endpoint, or feature, so the specific injection point cannot be confirmed from the available data. Limiting factors: the required victim interaction, dependence on the victim's browser executing the payload, and applicability only to LearnPress versions at or below 4.4.9.

This is a reflected/unauthenticated Cross-Site Scripting flaw (CWE-79) in the LearnPress WordPress plugin, rated CVSS 7.1 with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The signals are internally consistent for a typical web XSS: network-reachable (AV:N), low complexity (AC:L), no authentication (PR:N), but requiring user interaction (UI:R) and crossing a scope boundary (S:C) into the victim's browser session. No EPSS score, CISA KEV listing, POC reference, or SSVC decision data was provided in the input. Exploitation status is therefore 'no public exploit identified at time of analysis' - the single reference is the Patchstack advisory, which is a vulnerability disclosure, not evidence of active exploitation. The UI:R requirement materially lowers real-world risk versus a zero-click flaw: an attacker must lure a victim (potentially an authenticated admin) into clicking a crafted link or viewing attacker-controlled content. Net assessment: a genuine but moderate-priority issue - patch in the normal cycle, prioritizing internet-facing LearnPress sites - rather than an emergency, absent any exploitation or POC signal. Note the A:L (availability) impact in the supplied vector is atypical for pure XSS and should be verified with the vendor.

An attacker crafts a malicious URL or payload targeting a vulnerable LearnPress parameter and delivers it to a victim (e.g., a logged-in instructor or administrator) via phishing or a planted link. When the victim's browser renders the unsanitized input, attacker-controlled JavaScript executes in the site's origin, enabling session/cookie theft or actions on the victim's behalf. No public exploit code was identified at time of analysis, and successful exploitation depends on the required user interaction (UI:R).