Executive brief
LearnPress is a WordPress plugin used to create and manage online learning platforms and sell courses. A stored cross-site scripting (XSS) vulnerability allows authenticated course creators and administrators to inject malicious scripts into pages via a custom CSS parameter. When other users visit these pages, the injected scripts execute in their browsers, potentially compromising their accounts or exposing sensitive data.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the 'layout_custom_css' parameter caused by insufficient input sanitization and output escaping. An attacker with contributor-level access or higher can inject arbitrary JavaScript that persists in the database and executes whenever any user visits an affected page. The attack vector is network-based but requires authentication (contributor role minimum). The flaw affects LearnPress versions up to and including 4.3.9.1. Patch availability is not explicitly stated in the advisory.
Affected products
- LearnPress LearnPress 4.3.9.1 and earlier
Timeline
- 2026-09-08: disclosed