EUVD-2026-45885
GHSA-q3xc-67mx-mvw3
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Remote reflected XSS needs no attacker privileges (PR:N) but mandatory victim click (UI:R); script runs in victim's session crossing scope (S:C) with low confidentiality/integrity and no real availability impact (A:N).
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
4DescriptionCVE.org
The LearnPress WordPress plugin before 4.4.1 does not escape a search parameter before reflecting it into an HTML attribute, leading to Reflected Cross-Site Scripting that executes in the browser of a logged-in instructor or administrator who is tricked into opening a crafted link.
Articles & Coverage 1
AnalysisAI
Reflected Cross-Site Scripting in the LearnPress WordPress plugin before 4.4.1 lets a remote attacker execute arbitrary JavaScript in the browser of a logged-in instructor or administrator who opens a crafted link, because a search parameter is reflected into an HTML attribute without escaping. Publicly available exploit code exists (published by WPScan), but there is no public exploit identified as being used in active attacks; EPSS is low at 0.15% (5th percentile). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that a logged-in LearnPress instructor or administrator be tricked into opening an attacker-crafted URL that injects a payload into the unescaped search parameter reflected into an HTML attribute (CVSS UI:R confirms mandatory user interaction). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are consistent and point to a moderate, not critical, priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a LearnPress URL containing a malicious payload in the vulnerable search parameter and sends it via email or chat to a course instructor or site administrator. When the logged-in victim opens the link, the unescaped value breaks out of the HTML attribute and the injected JavaScript executes in their authenticated session, allowing theft of session cookies or the performance of privileged actions on their behalf. … |
| Remediation | Vendor-released patch: upgrade LearnPress to version 4.4.1 or later, which is the primary and definitive fix; the update is available from the vendor and referenced via the WPScan advisory (https://wpscan.com/vulnerability/d0a2780f-ab13-4bb8-935d-2aeba1de12d2/) and NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-12970). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct an audit of all WordPress installations to identify systems running LearnPress below version 4.4.1, document affected instances, and verify which instructor and administrator accounts could be exposed. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Learnpress
View allSQL injection in LearnPress LMS plugin for WordPress (versions ≤ 4.2.7) allows unauthenticated remote attackers to injec
SQL injection in the LearnPress LMS plugin for WordPress (versions up to and including 4.2.6.5) allows remote unauthenti
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_fields' parameter o
The LearnPress WordPress plugin before 4.1.4 does not sanitise, validate and escape the id parameter before using it in
LearnPress Wordpress plugin version prior and including 3.2.6.7 is vulnerable to SQL Injection. Rated high severity (CVS
The LearnPress WordPress plugin before 4.1.7.2 unserialises user input in a REST API endpoint available to unauthenticat
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versio
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file t
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versio
The LearnPress WordPress plugin before 4.1.6 does not sanitise and escape the lp-dismiss-notice before outputting it bac
The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to bypass to user registration in versions up t
LearnPress WordPress plugin versions prior to 4.3.7 expose sensitive user account metadata to unauthenticated visitors t
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today