LearnPress CVE-2026-12970

Exploitation requires that a logged-in LearnPress instructor or administrator be tricked into opening an attacker-crafted URL that injects a payload into the unescaped search parameter reflected into an HTML attribute (CVSS UI:R confirms mandatory user interaction). The attacker needs no authentication or privileges of their own (PR:N), and the target site must run LearnPress before version 4.4.1. Limiting factors: the payload is reflected (non-persistent), so it only fires for the specific victim who clicks the specific crafted link and only while that victim holds an active privileged session; there is no server-side persistence and no automatable mass-exploitation path (SSVC Automatable: no), so realistic impact is confined to targeted social-engineering against high-value operator accounts.

The signals are consistent and point to a moderate, not critical, priority. The CVSS 3.1 base is 7.1 (High) with AV:N/AC:L/PR:N but crucially UI:R - successful exploitation depends on socially engineering a privileged user (instructor or admin) into clicking an attacker-crafted link, which meaningfully lowers real-world exploitability. SSVC aligns with this: exploitation status is 'poc' (not active), Automatable is 'no' (each attack requires per-victim link delivery and interaction), and Technical Impact is 'partial' (matching C:L/I:L). EPSS of 0.15% (5th percentile) and the absence of CISA KEV listing reinforce that widespread automated exploitation is unlikely; this is a targeted, phishing-style risk against high-value WordPress operators. The scope-change flag (S:C) in the vendor vector is defensible for XSS since the injected script executes in the victim's authenticated browser context. No key signals conflict, though the A:L (availability) impact in the published vector is generous for a reflected XSS and is likely an overestimate.

An attacker crafts a LearnPress URL containing a malicious payload in the vulnerable search parameter and sends it via email or chat to a course instructor or site administrator. When the logged-in victim opens the link, the unescaped value breaks out of the HTML attribute and the injected JavaScript executes in their authenticated session, allowing theft of session cookies or the performance of privileged actions on their behalf. Publicly available exploit code from WPScan lowers the barrier to reproducing this attack.