Executive brief
LearnPress, a popular WordPress plugin used to create and sell online courses, contains a security flaw that allows users with contributor-level access to inject malicious scripts into website pages. These scripts execute automatically when other users, including site administrators or students, visit the affected pages. This could lead to unauthorized actions being performed on behalf of users or the theft of sensitive session information.
Technical details
The LearnPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on the 'skin' attribute within the 'learn_press_courses' shortcode. The vulnerability exists because the attribute value is passed directly into an sprintf() function to generate HTML class and data-layout attributes without being processed by esc_attr(). An authenticated attacker with Contributor-level privileges or higher can exploit this to inject malicious JavaScript. The payload is stored in the database and executes in the context of any user viewing the page. A patch was introduced in version 4.3.3 (or subsequent changeset 3494377).
Affected products
- ThimPress LearnPress – WordPress LMS Plugin up to and including 4.3.3
Timeline
- 2026-04-08: disclosed: Initial disclosure by Wordfence
- 2026-04-08: advisory: NVD publication date
References
- https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.2.8/inc/Shortcodes/Courses/ListCoursesShortcode.php
- https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.2.8/inc/Shortcodes/Courses/ListCoursesShortcode.php
- https://plugins.trac.wordpress.org/browser/learnpress/trunk/inc/Shortcodes/Courses/ListCoursesShortcode.php
- https://plugins.trac.wordpress.org/browser/learnpress/trunk/inc/Shortcodes/Courses/ListCoursesShortcode.php
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3494377%40learnpress&new=3494377%40learnpress&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/15fb0a26-e415-4ccb-b83d-d8f7b36bce66?source=cve