# CVE-2026-109208: LearnPress WordPress LMS plugin stored cross-site scripting

Source: https://junglewise.ai/threats/cve-2026-109208-the-learnpress-wordpress-lms-plugin-for-create-and-sell-online  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-17. Updated: 2026-10-17  
License: CC BY 4.0 with a link back

CVE-2026-109208 · Severity: high · CVSS 7.2 · Published 2026-10-17

LearnPress is a WordPress plugin for creating and selling online courses. Attackers can inject malicious scripts through order comments or product quantity fields that execute when users view affected pages, allowing account compromise or credential theft. With guest checkout enabled, completely unauthenticated attackers can inject the malicious content; otherwise any user with a customer account can perform the attack.

Technologies: [LearnPress](https://junglewise.ai/threats/technologies/learnpress-learnpress). Vendors: [LearnPress](https://junglewise.ai/threats/vendors/learnpress).

## Quick answers

**Is CVE-2026-109208 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-109208 being exploited in the wild.

**How severe is CVE-2026-109208?** High severity, with a CVSS score of 7.2, published 17 October 2026.

**Which products and versions are affected?** LearnPress all versions up to and including 4.4.10.

**Is there a fix for CVE-2026-109208?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-109208 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-109208?** Check whether you run LearnPress at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The plugin fails to properly sanitize and escape user input in the quantity (REST API) and order_comments (checkout form) parameters. Unauthenticated attackers (if guest checkout is enabled) or Subscriber-level users can inject arbitrary JavaScript that persists in the database and executes in the browsers of administrators and other users accessing the affected pages. This is a stored XSS vulnerability affecting all versions through 4.4.10.

## Affected products

- LearnPress LearnPress all versions up to and including 4.4.10

## Timeline

- 2026-10-17: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.10/assets/src/js/admin/order/refund-order.js](https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.10/assets/src/js/admin/order/refund-order.js)
- [https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.10/inc/admin/views/meta-boxes/order/content-tab-preview-exports-invoice.php](https://plugins.trac.wordpress.org/browser/learnpress/tags/4.4.10/inc/admin/views/meta-boxes/order/content-tab-preview-exports-invoice.php)

## Related threats

- [LearnPress authorization bypass in admin editors](https://junglewise.ai/threats/cve-2026-113353-learnpress-before-4-4-10-contains-a-missing-authorization)
- [LearnPress authorization bypass in user search](https://junglewise.ai/threats/cve-2026-107744-the-learnpress-wordpress-lms-plugin-for-create-and-sell-online)
- [LearnPress PHP Object Injection in checkout handler](https://junglewise.ai/threats/cve-2026-104736-the-learnpress-plugin-for-wordpress-is-vulnerable-to-php-object)
- [LearnPress cross-site scripting (XSS) vulnerability](https://junglewise.ai/threats/cve-2026-104670-unauthenticated-cross-site-scripting-xss-in-learnpress-4-4-9)
- [LearnPress plugin stored cross-site scripting in quiz questions](https://junglewise.ai/threats/cve-2026-105397-learnpress-plugin-for-wordpress-through-4-4-9-1-contains-a)