What is the CVSS score of EUVD-2026-45885?

EUVD-2026-45885 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of LearnPress are affected by EUVD-2026-45885?

LearnPress WordPress plugin versions before 4.4.1 contain a reflected XSS vulnerability that allows attackers to inject arbitrary code into the browsers of logged-in instructors and administrators…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-45885?

Yes, a public proof-of-concept exploit is available for EUVD-2026-45885. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate EUVD-2026-45885?

Within 24 hours, conduct an audit of all WordPress installations to identify systems running LearnPress below version 4.4.1, document affected instances, and verify which instructor and administrator accounts could be exposed. Within 7 days, apply the vendor patch by upgrading LearnPress to version 4.4.1 or later on all affected systems and verify successful deployment through WordPress plugin status confirmation. Within 30 days, review access and authentication logs from the vulnerability period for indicators of suspicious activity, disable or remove outdated plugin versions from all backup and archived systems, and conduct spot checks on administrator and instructor workflows to ensure platform integrity was not compromised.

LearnPress EUVD-2026-45885

| CVE-2026-12970 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-20 WPScan

GHSA-q3xc-67mx-mvw3

WordPress XSS Learnpress Unknown

7.1

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Remote reflected XSS needs no attacker privileges (PR:N) but mandatory victim click (UI:R); script runs in victim's session crossing scope (S:C) with low confidentiality/integrity and no real availability impact (A:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:32 vuln.today

Patch available

Jul 20, 2026 - 09:17 EUVD

CVE Published

Jul 20, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 20, 2026 - 06:00 cve.org

HIGH 7.1

DescriptionCVE.org

The LearnPress WordPress plugin before 4.4.1 does not escape a search parameter before reflecting it into an HTML attribute, leading to Reflected Cross-Site Scripting that executes in the browser of a logged-in instructor or administrator who is tricked into opening a crafted link.

Articles & Coverage 1

News 6 New WordPress Vulnerabilities - 1 Critical, 5 High, All With POC Jul 21, 2026

AnalysisAI

Reflected Cross-Site Scripting in the LearnPress WordPress plugin before 4.4.1 lets a remote attacker execute arbitrary JavaScript in the browser of a logged-in instructor or administrator who opens a crafted link, because a search parameter is reflected into an HTML attribute without escaping. Publicly available exploit code exists (published by WPScan), but there is no public exploit identified as being used in active attacks; EPSS is low at 0.15% (5th percentile). A vendor patch is available in version 4.4.1.

Technical ContextAI

LearnPress is a Learning Management System (LMS) plugin for WordPress used to build online courses and instructor/student portals. The flaw is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) failure: a user-supplied search parameter is echoed back into an HTML attribute context without output encoding or attribute-context escaping, allowing an attacker to break out of the attribute and inject script that runs with the privileges of the viewing user's authenticated WordPress session. Because it is reflected (non-persistent), the payload must be delivered per-request via a crafted URL rather than stored server-side. The CPE (cpe:2.3:a:unknown:learnpress:*) confirms the LearnPress application as the affected component across all versions prior to the fix, with the vendor field unresolved in the source feed.

RemediationAI

Vendor-released patch: upgrade LearnPress to version 4.4.1 or later, which is the primary and definitive fix; the update is available from the vendor and referenced via the WPScan advisory (https://wpscan.com/vulnerability/d0a2780f-ab13-4bb8-935d-2aeba1de12d2/) and NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-12970). If immediate patching is not possible, deploy a Web Application Firewall rule (for example WPScan/Wordfence signatures) to filter script metacharacters and attribute-breakout sequences in the affected search request, accepting that WAF rules can be bypassed and may cause false positives on legitimate searches; additionally, instruct instructors and administrators not to open unsolicited LearnPress admin links and consider restricting admin/instructor dashboard access by IP allowlisting, which limits where a crafted link can be triggered but adds operational overhead for remote staff. These are stopgaps only - applying 4.4.1 is strongly preferred.