LearnPress CVE-2026-92538

Exploitation requires an attacker to deliver a crafted URL whose 'orderby' parameter carries a script payload that LearnPress (≤4.4.7) reflects into the DOM without sufficient sanitization/output escaping, AND a victim must actively click or load that attacker-controlled link (UI:R) for the script to execute in their browser. No authentication is required of the attacker (PR:N). Key limiting factors: success depends entirely on social-engineering a user into following the malicious link, impact is confined to the victim's browser session (Low C/I, no availability or server-side compromise), and exploitation is per-victim rather than automatable against the server.

This is a moderate-severity, interaction-dependent issue rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, 6.1) confirms a network-reachable, unauthenticated flaw, but the UI:R requirement means an attacker cannot exploit it without tricking a victim into clicking a crafted link, which substantially lowers real-world likelihood of mass exploitation. No EPSS score, no CISA KEV entry, and no public POC were supplied in the input, so exploitation status is 'no public exploit identified at time of analysis' - all three exploitation signals are either absent or negative and none conflict. No SSVC decision data was provided. The scope change (S:C) and only Low confidentiality/integrity impact are consistent with a reflected DOM-based XSS that executes in the victim's browser session rather than compromising the server. Net: a legitimate issue worth patching on a normal cadence, but not a high-urgency priority absent evidence of active exploitation. The affected product's wide install base (LearnPress) raises aggregate exposure even though per-target exploitation is low-probability.

An unauthenticated attacker crafts a URL targeting a LearnPress page with a malicious payload in the 'orderby' parameter and lures a logged-in user (e.g. an admin or instructor) into clicking it via phishing or a planted link. When the victim's browser processes the reflected, DOM-rendered value, the injected script executes in their session context, enabling actions such as session/cookie theft or forged requests. No public exploit code is referenced in the available data, and successful attack depends on the victim clicking the attacker-supplied link.