LearnPress EUVD-2026-103216

Two injection vectors are involved: the 'quantity' parameter handled by the LearnPress frontend REST courses controller, and the 'order_comments' field in the checkout flow. Exploitation is fully unauthenticated only when the site has guest checkout enabled; when guest checkout is disabled, the attacker needs any Subscriber-level account and exploits both vectors through their own checkout. The stored payload executes when a user - in practice a store administrator - views the affected order details or invoice export page in wp-admin, so the impact is realized through routine operator activity rather than attacker-triggered. Limiting factors: dependence on the guest-checkout setting for the unauthenticated path, and the need for a victim to open the affected order/invoice page.

This is a credible but moderate-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C) and the 7.2 base score reflect network-reachable, low-complexity stored XSS with a scope change, where injection in a buyer-facing checkout flow executes in a different security context (the WordPress admin viewing orders/invoices). The PR:N rating is only valid in the guest-checkout-enabled configuration explicitly called out in the description; with guest checkout disabled, a Subscriber-level account is required, so real-world privilege requirements depend on site configuration - the single CVSS vector flattens two materially different attack preconditions. No EPSS score, CISA KEV entry, or public POC is present in the supplied data, so there is no evidence of active exploitation. Confidentiality and integrity impacts are Low (C:L/I:L, A:N), consistent with session/DOM-level script execution rather than direct code execution. Net: a real, patchable XSS in a widely-installed plugin that warrants prompt patching, but not an emergency on the level of an actively-exploited RCE. Note the UI:N choice is debatable since the payload executes only when a victim (typically an admin) views the affected order page - routine for store operators, but technically a form of required interaction.

An attacker places an order through the LearnPress checkout and submits a malicious script payload in the 'order_comments' field (or the REST 'quantity' parameter), which is stored without sanitization. When a site administrator later opens the order details or invoice export in wp-admin, the script executes in the admin's authenticated session, enabling actions such as session/cookie theft or admin-context request forgery. With guest checkout enabled this requires no authentication at all; otherwise a free Subscriber account suffices. No public exploit code was identified at time of analysis.