# CVE-2026-105397: LearnPress plugin stored cross-site scripting in quiz questions

Source: https://junglewise.ai/threats/cve-2026-105397-learnpress-plugin-for-wordpress-through-4-4-9-1-contains-a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-05. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-105397 · Severity: medium · CVSS 5.4 · Published 2026-10-05

LearnPress is a learning management system plugin for WordPress that allows instructors to create and manage courses with quizzes. An authenticated instructor can inject malicious scripts into quiz question hints and explanations that will execute in the browsers of every student taking the quiz, potentially stealing their data or session tokens.

Technologies: [LearnPress](https://junglewise.ai/threats/technologies/learnpress-learnpress). Vendors: [LearnPress](https://junglewise.ai/threats/vendors/learnpress).

## Quick answers

**Is CVE-2026-105397 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105397 being exploited in the wild.

**How severe is CVE-2026-105397?** Medium severity, with a CVSS score of 5.4, published 5 October 2026.

**Which products and versions are affected?** LearnPress through 4.4.9.1.

**Is there a fix for CVE-2026-105397?** Yes: fixed in 4.5.0 or later (based on commit 9db279c0d9fd3993430bb9af158658282e9bcee1). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-105397 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-105397?** Check whether you run LearnPress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.5.0 or later (based on commit 9db279c0d9fd3993430bb9af158658282e9bcee1)

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in the LearnPress plugin's update_question AJAX handler, which fails to sanitize user input in quiz question hint and explanation fields. Authenticated users with the Instructor role can exploit this by submitting unsanitized payloads that are stored in the database and executed whenever students view or interact with the affected quiz questions.

## Affected products

- LearnPress LearnPress through 4.4.9.1

## Timeline

- 2026-10-05: disclosed

## References

- [https://github.com/LearnPress/learnpress/commit/9db279c0d9fd3993430bb9af158658282e9bcee1](https://github.com/LearnPress/learnpress/commit/9db279c0d9fd3993430bb9af158658282e9bcee1)
- [https://plugins.svn.wordpress.org/learnpress/tags/4.4.9.1/assets/src/apps/js/frontend/quiz/components/questions/question.js](https://plugins.svn.wordpress.org/learnpress/tags/4.4.9.1/assets/src/apps/js/frontend/quiz/components/questions/question.js)

## Related threats

- [LearnPress authorization bypass in admin editors](https://junglewise.ai/threats/cve-2026-113353-learnpress-before-4-4-10-contains-a-missing-authorization)
- [LearnPress authorization bypass in user search](https://junglewise.ai/threats/cve-2026-107744-the-learnpress-wordpress-lms-plugin-for-create-and-sell-online)
- [LearnPress PHP Object Injection in checkout handler](https://junglewise.ai/threats/cve-2026-104736-the-learnpress-plugin-for-wordpress-is-vulnerable-to-php-object)
- [LearnPress WordPress LMS plugin stored cross-site scripting](https://junglewise.ai/threats/cve-2026-109208-the-learnpress-wordpress-lms-plugin-for-create-and-sell-online)
- [LearnPress cross-site scripting (XSS) vulnerability](https://junglewise.ai/threats/cve-2026-104670-unauthenticated-cross-site-scripting-xss-in-learnpress-4-4-9)