CVE-2026-104403

LearnPress (WordPress plugin) through version 4.4.9.1 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

The LearnPress plugin for WordPress up to version 4.4.7 is vulnerable to reflected DOM-based XSS via the 'orderby' parameter. Unauthenticated attackers can inject scripts that execute when a user clicks a crafted link.

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities before applying a user supplied post status filter in one of its REST routes. Unauthenticated attackers can list courses that are not published, including draft, pending, private, scheduled and trashed ones.

The LearnPress WordPress plugin before 4.4.7 does not perform any authentication, capability or nonce check before serving a previously generated order export file. Unauthenticated attackers who can determine its identifier can download customer names, purchases, amounts and guest email addresses.

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative course tools. Unauthenticated attackers can list every enrolled student's display name and user identifier against the course they are enrolled on, and recover their email addresses through the same handler's search filter.

The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities in one of its administrative template handlers. Unauthenticated attackers can retrieve the text, identifier and type of every published quiz question on the site, along with a keyword search over them, which is content the LearnPress WordPress plugin before 4.4.7 otherwise keeps non-public.

The LearnPress WordPress plugin before 4.4.7 does not escape a user supplied value before using it in an HTML attribute on a public page. Unauthenticated attackers can execute arbitrary JavaScript in the browser of anyone who opens a crafted link, including a logged in administrator. Only sites running a classic, non-block mode are affected.

The LearnPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'layout_custom_css' parameter in all versions up to and including 4.3.9.1 due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts that execute when a user accesses an injected page.

LearnPress WordPress Plugin before 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers with the Instructor role to inject persistent malicious payloads by submitting unsanitized input into quiz question answer title fields. Attackers can store arbitrary JavaScript through the answer title parameter, which is rendered through an unescaped HTML sink to execute in the browsers of any user who views the affected quiz question, including students, other instructors, and administrators.

The LearnPress WordPress plugin before version 4.4.6 contains a broken object-level authorization vulnerability that allows authenticated attackers with the Instructor role to add answers to quiz questions owned by other instructors. A missing ownership check on the answer insertion path lets attackers supply arbitrary question identifiers and bypass instructor-boundary restrictions.