LearnPress CVE-2026-105397

Exploitation requires an authenticated account with the LearnPress Instructor role (PR:L) able to reach the update_question AJAX handler, and it requires a victim student to actually open/take the affected quiz so the stored payload in the question hint or explanation field renders (UI:P). It is limited to deployments of the LearnPress plugin at or below version 4.4.9.1 where Instructor-level accounts exist and are not fully trusted; it does not yield direct compromise of the server or the vulnerable WordPress system itself, only script execution in viewing students' browser sessions. There is no unauthenticated path - the attacker must already hold or seize instructor privileges.

This is a genuine but moderate-severity issue, not a drop-everything priority. The only CVSS data provided is a CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N, base 5.1): network vector with low complexity, but it requires existing privileges (PR:L, an Instructor account) and passive user interaction (UI:P, a student must open the quiz). Vulnerable-system impact is nil (VC/VI/VA:N); the harm is entirely on the subsequent system - the student's browser session - reflected as SC:L/SI:L. No EPSS score, no CISA KEV listing, and no public POC were supplied, so by the precision rules this is 'no public exploit identified at time of analysis.' There is no signal conflict: a low-ish severity, an authenticated-attacker precondition, and the absence of exploitation telemetry all point the same direction - a real, vendor-confirmed stored XSS that is realistically abused only inside a course by a malicious or compromised instructor, not mass-exploited across the internet. The constraining factor is trust: whoever holds Instructor rights already has a privileged, semi-trusted relationship with the site, which bounds the attacker population.

A user holding the WordPress Instructor role (or an attacker who has compromised such an account) submits a quiz question through the update_question AJAX handler with a malicious script embedded in the question's hint or explanation field, which LearnPress stored without sanitization. When any student subsequently takes that quiz, the stored payload executes in the student's authenticated browser session, enabling session/cookie theft or actions on the student's behalf. No public exploit code was identified, but the attack requires only standard instructor functionality and is straightforward given low attack complexity.