LearnPress CVE-2026-86444

Exploitation requires the target site to run LearnPress before 4.4.7 with a classic (non-block) WordPress theme - block-based themes are not affected, which is a meaningful limiting factor. No authentication is needed by the attacker (PR:N), but successful execution depends on victim user interaction (UI:R): the attacker must lure someone - ideally a logged-in administrator - into opening a crafted link so the payload lands in the unescaped HTML attribute on a public page. Impact is maximized only when the victim is privileged; a click by an anonymous visitor yields limited value.

This is a reflected/DOM-injected XSS (CWE-79) in LearnPress, carrying a vendor CVSS of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The elevated score is driven almost entirely by the scope change (S:C) - script executing in the victim's authenticated context can pivot beyond the vulnerable component - rather than by direct impact, which is uniformly Low (C:L/I:L/A:L). Attack vector is network and unauthenticated (PR:N), but exploitation is gated by user interaction (UI:R): a victim, ideally a logged-in administrator, must open an attacker-crafted link. Cross-referencing exploitation signals shows a mixed picture: a public exploit exists (WPScan advisory, so 'publicly available exploit code exists'), but EPSS is only 0.22% (13th percentile) and there is no CISA KEV listing, indicating no confirmed active/widespread exploitation. This is a plausibly-real but not top-tier priority: reflected XSS requiring social-engineering to reach a privileged victim is common and patchable, so it warrants patching in the normal cycle rather than emergency response. Note the vector's PR:N/AV:N combined with the mandatory UI:R and the classic-theme-only precondition means real-world exploitability is narrower than the 7.1 headline suggests. CPE lists vendor as 'unknown', so affected-product identity relies on the description/EUVD rather than a clean NVD vendor mapping.

An attacker crafts a URL against a LearnPress-powered site running a classic (non-block) theme, embedding JavaScript that breaks out of an unescaped HTML attribute on a public page. The attacker sends this link to a site administrator (phishing/DM), and when the admin opens it their browser executes the attacker's script in the authenticated session - enabling actions such as creating rogue admin accounts or stealing session data. A public proof-of-concept is available via the WPScan advisory.