Junglewise Threat Intelligence

CVE-2026-4333: ThimPress LearnPress Stored XSS in learn_press_courses shortcode

CVE-2026-4333 · Severity: medium · CVSS 6.4 · Published 2026-04-08

Technologies: ThimPress LearnPress. Vendors: ThimPress.

Executive brief

LearnPress, a popular WordPress plugin used to create and sell online courses, contains a security flaw that allows users with contributor-level access to inject malicious scripts into website pages. These scripts execute automatically when other users, including site administrators or students, visit the affected pages. This could lead to unauthorized actions being performed on behalf of users or the theft of sensitive session information.

Technical details

The LearnPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'skin' attribute within the 'learn_press_courses' shortcode. The vulnerability exists because the attribute value is passed directly into an sprintf() function to generate HTML class and data-layout attributes without being processed by esc_attr(). An authenticated attacker with Contributor-level privileges or higher can exploit this to inject malicious JavaScript. The payload is stored in the database and executes in the context of any user viewing the page. A patch was introduced in version 4.3.3 (or subsequent changeset 3494377).

Affected products

  • ThimPress LearnPress – WordPress LMS Plugin up to and including 4.3.3

Timeline

  • 2026-04-08: disclosed: Initial disclosure by Wordfence
  • 2026-04-08: advisory: NVD publication date

References

Related threats