Executive brief
The LearnPress WordPress plugin fails to properly escape user input in the 'skin' parameter before displaying it in an HTML attribute on public pages. This allows attackers to inject malicious JavaScript that executes in the browsers of anyone visiting a crafted link, including site administrators. The vulnerability affects only sites running classic WordPress themes, not block-based themes.
Technical details
The vulnerability is a reflected Cross-Site Scripting (XSS) flaw (CWE-79) where the 'skin' parameter is not escaped before being used in an HTML attribute on a public-facing page. An unauthenticated attacker can craft a malicious URL containing JavaScript payload in the skin parameter; when a user (including administrators) clicks the link, the script executes in their browser with their privileges. No authentication or special preconditions are required beyond the victim clicking a crafted link. The vulnerability is fixed in LearnPress version 4.4.7.
Affected products
- LearnPress LearnPress before 4.4.7
Timeline
- 2026-09-14: disclosed
- 2026-09-16: patched: Fixed in version 4.4.7