CVE-2026-12732
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The LearnPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class_wrapper_form' shortcode attribute in versions up to and including 4.4.0. Authenticated attackers with contributor-level access or higher can inject arbitrary scripts that execute when users visit the affected page.
Risk Assessment
The risk includes session hijacking, data theft, or distribution of malicious code within the WordPress site, potentially compromising security and organizational reputation.
Recommendation
Immediately update the LearnPress plugin to version 4.4.1 or later, which includes a fix for this vulnerability. Also, restrict user permissions to the minimum necessary.
Other vulnerabilities in LearnPress
See all- CVE-2026-75982Medium
The LearnPress plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in versions up to and including 4.4.4 via the learnpress_create_page AJAX action. Attackers with Editor-level access can update arbitrary options, such as users_can_register or active_plugins, potentially enabling public registration or breaking the site.
- CVE-2026-12976Medium
The LearnPress WordPress plugin before version 4.4.4 does not verify that a user is enrolled in a course before processing AI-assistant requests against that course's lesson content, allowing any authenticated user such as a subscriber to obtain material from paid courses they have not enrolled in.
- CVE-2026-12970High
The LearnPress WordPress plugin before version 4.4.1 does not escape a search parameter before reflecting it into an HTML attribute, leading to Reflected Cross-Site Scripting (XSS). An attacker can exploit this vulnerability to execute a malicious script in the browser of a logged-in instructor or administrator who is tricked into opening a crafted link.
- CVE-2026-13765High
The LearnPress WordPress LMS plugin up to version 4.4.1 is vulnerable to sensitive information exposure via the check_answer function. Unauthenticated attackers can extract correct answer markers, full option lists, explanations, and question content for any quiz question, including those from paid courses the attacker is not enrolled in.
- CVE-2026-11988Medium
The LearnPress WordPress LMS plugin up to version 4.3.9.1 is vulnerable to Insecure Direct Object Reference (IDOR) via the 'userId' parameter. An authenticated attacker with subscriber-level access or higher can view course enrollment progress and completion data belonging to instructors and administrators.
- CVE-2026-8502Medium
The LearnPress plugin for WordPress up to version 4.3.6 exposes sensitive data via the 'return_type' parameter. An unauthenticated attacker can extract passwords for protected courses and content, author, and name of unpublished posts.
- CVE-2026-48865High
LearnPress WordPress plugin is vulnerable to Reflected XSS due to improper input neutralization during page generation. Affects versions up to 4.3.6.
- CVE-2026-4333Medium
The LearnPress – WordPress LMS Plugin is vulnerable to Stored Cross-Site Scripting via the 'skin' attribute of the learn_press_courses shortcode in all versions up to and including 4.3.3. Insufficient input sanitization and output escaping on the 'skin' attribute allows authenticated attackers (Contributor-level and above) to inject arbitrary web scripts.
Original NVD description (English source)
The LearnPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class_wrapper_form' shortcode attribute in versions up to, and including, 4.4.0. This is due to insufficient input sanitization and output escaping in the FilterCourseTemplate::sections() method at line 98, where the attacker-controlled attribute is inserted into an HTML class attribute via sprintf('<form class="%s">', $class_wrapper_form) without esc_attr() escaping. The FilterCourseShortcode::render() handler does not apply shortcode_atts() filtering, so raw user attributes flow directly through do_action('learn-press/filter-courses/layout', $data) into the template. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.