Is there a public PoC exploit available for CVE-2026-86444?

Yes, a public proof-of-concept exploit is available for CVE-2026-86444. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2026-86444?

Yes, a patch is available for CVE-2026-86444. Update the affected software to the latest version immediately.

Learnpress CVE-2026-86444

EUVD-2026-80200

2026-09-16 WPScan

GHSA-j44q-39v9-q752

WordPress Information Disclosure Learnpress

Lifecycle Timeline

Patch available

Sep 16, 2026 - 07:01 EUVD

CVE Published

Sep 16, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The LearnPress WordPress plugin before 4.4.7 does not escape a user supplied value before using it in an HTML attribute on a public page, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of anyone who opens a crafted link, including a logged in administrator. Only sites running a classic, non-block are affected.

Analysis

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Learnpress

View all

CVE-2024-8522 CRITICAL Act Now POC

10.0 Sep 12

SQL injection in LearnPress LMS plugin for WordPress (versions ≤ 4.2.7) allows unauthenticated remote attackers to injec

CVE-2023-6634 HIGH Act Now POC

8.1 Jan 11

The LearnPress plugin for WordPress is vulnerable to Command Injection in all versions up to, and including, 4.2.5.7 via

CVE-2023-6567 CRITICAL Emergency POC

9.8 Jan 11

The LearnPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order_by’ parameter in all versio

CVE-2024-4434 CRITICAL Emergency POC

9.8 May 14

SQL injection in the LearnPress LMS plugin for WordPress (versions up to and including 4.2.6.5) allows remote unauthenti

CVE-2024-8529 CRITICAL Act Now POC

10.0 Sep 12

The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to SQL Injection via the 'c_fields' parameter o

CVE-2021-24951 CRITICAL Act Now POC

9.8 Dec 13

The LearnPress WordPress plugin before 4.1.4 does not sanitise, validate and escape the id parameter before using it in

CVE-2026-12976 MEDIUM This Month POC

6.5 Aug 12

Unauthorized access to paid course content in LearnPress WordPress plugin (all versions before 4.4.4) allows any authent

CVE-2020-6010 HIGH This Week POC

8.8 Apr 30

LearnPress Wordpress plugin version prior and including 3.2.6.7 is vulnerable to SQL Injection. Rated high severity (CVS

CVE-2022-3360 HIGH This Week POC

8.1 Oct 31

The LearnPress WordPress plugin before 4.1.7.2 unserialises user input in a REST API endpoint available to unauthenticat

CVE-2024-11868 MEDIUM This Month POC

5.3 Dec 10

The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versio

CVE-2026-12970 HIGH This Week POC

7.1 Jul 20

Reflected Cross-Site Scripting in the LearnPress WordPress plugin before 4.4.1 lets a remote attacker execute arbitrary

CVE-2024-4397 HIGH This Week

8.8 May 14

The LearnPress - WordPress LMS Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file t

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

CVE-2026-86444 vulnerability details – vuln.today

Back