Executive brief
LearnPress is a WordPress learning management system plugin used to create and sell online courses. A stored cross-site scripting vulnerability in versions before 4.4.6 allows instructors to inject malicious JavaScript into quiz answer titles, which is executed when students, administrators, or other instructors view the affected quiz. This could be used to steal user credentials, deface course content, or redirect users to malicious sites.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the quiz question answer title field. Authenticated users with the Instructor role can submit unsanitized input to the answer title parameter, which is stored in the database and later rendered without proper HTML escaping in an unescaped HTML sink. The attack requires network access and authentication as an Instructor, but only requires user interaction (visiting the quiz page) from victims. An attacker can inject arbitrary JavaScript that executes in the browsers of any user viewing the affected quiz question, including students, instructors, and administrators. The vulnerability was fixed in version 4.4.6.
Affected products
- ThimPress LearnPress before 4.4.6
Timeline
- 2026-09-03: disclosed
- 2026-09-03: patched: Version 4.4.6 available