Learnpress Wordpress Lms Plugin For Create And Sell Online Courses CVE-2026-4333

CVSS 6.4 (Medium) with network attack vector and low complexity reflects a realistic threat profile. The PR:L (Contributor-level privilege requirement) significantly limits the attack surface compared to unauthenticated exploits, as WordPress sites with open registration are less common and contributors are typically semi-trusted users. However, the S:C (Scope Change) component indicates impact beyond the vulnerable component, and stored XSS affecting all site visitors elevates severity. EPSS exploitation probability and KEV status are not provided, suggesting this is not currently confirmed in active exploitation databases. The public availability of vulnerable code paths (via WordPress plugin repository) means proof-of-concept development would be straightforward for researchers. Real-world risk depends on site configuration: sites with restricted contributor access face minimal risk, while those with open registration or compromised contributor accounts face significant cookie theft, session hijacking, or malware injection risks. The requirement for an authenticated user to inject the payload is the primary limiting factor.

A malicious WordPress contributor (or an attacker who has compromised a contributor account) crafts a page with the learn_press_courses shortcode, injecting JavaScript into the 'skin' attribute such as [learn_press_courses skin="test" onload="alert('xss')"], which bypasses sanitization because the attribute is directly embedded into HTML. When any website visitor (including administrators) views this page, the injected script executes in their browser within the site's security context, allowing the attacker to steal session cookies, deface content, or inject further malware. No public exploit code proof-of-concept has been identified at time of analysis, but the vulnerability is straightforward to exploit given knowledge of the vulnerable code path.