CVE-2026-12970
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The LearnPress WordPress plugin before version 4.4.1 does not escape a search parameter before reflecting it into an HTML attribute, leading to Reflected Cross-Site Scripting (XSS). An attacker can exploit this vulnerability to execute a malicious script in the browser of a logged-in instructor or administrator who is tricked into opening a crafted link.
Risk Assessment
The risk involves potential session hijacking or unauthorized actions on an administrator or instructor account, which could lead to data theft, course content modification, or further propagation of the attack within the WordPress environment.
Recommendation
Immediately update the LearnPress plugin to version 4.4.1 or later. Additionally, train users to recognize suspicious links and consider deploying a Web Application Firewall (WAF) to block XSS attacks.
Other vulnerabilities in LearnPress
See all- CVE-2026-75982Medium
The LearnPress plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in versions up to and including 4.4.4 via the learnpress_create_page AJAX action. Attackers with Editor-level access can update arbitrary options, such as users_can_register or active_plugins, potentially enabling public registration or breaking the site.
- CVE-2026-12976Medium
The LearnPress WordPress plugin before version 4.4.4 does not verify that a user is enrolled in a course before processing AI-assistant requests against that course's lesson content, allowing any authenticated user such as a subscriber to obtain material from paid courses they have not enrolled in.
- CVE-2026-13765High
The LearnPress WordPress LMS plugin up to version 4.4.1 is vulnerable to sensitive information exposure via the check_answer function. Unauthenticated attackers can extract correct answer markers, full option lists, explanations, and question content for any quiz question, including those from paid courses the attacker is not enrolled in.
- CVE-2026-12732Medium
The LearnPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class_wrapper_form' shortcode attribute in versions up to and including 4.4.0. Authenticated attackers with contributor-level access or higher can inject arbitrary scripts that execute when users visit the affected page.
- CVE-2026-11988Medium
The LearnPress WordPress LMS plugin up to version 4.3.9.1 is vulnerable to Insecure Direct Object Reference (IDOR) via the 'userId' parameter. An authenticated attacker with subscriber-level access or higher can view course enrollment progress and completion data belonging to instructors and administrators.
- CVE-2026-8502Medium
The LearnPress plugin for WordPress up to version 4.3.6 exposes sensitive data via the 'return_type' parameter. An unauthenticated attacker can extract passwords for protected courses and content, author, and name of unpublished posts.
- CVE-2026-48865High
LearnPress WordPress plugin is vulnerable to Reflected XSS due to improper input neutralization during page generation. Affects versions up to 4.3.6.
- CVE-2026-4333Medium
The LearnPress – WordPress LMS Plugin is vulnerable to Stored Cross-Site Scripting via the 'skin' attribute of the learn_press_courses shortcode in all versions up to and including 4.3.3. Insufficient input sanitization and output escaping on the 'skin' attribute allows authenticated attackers (Contributor-level and above) to inject arbitrary web scripts.
Original NVD description (English source)
The LearnPress WordPress plugin before 4.4.1 does not escape a search parameter before reflecting it into an HTML attribute, leading to Reflected Cross-Site Scripting that executes in the browser of a logged-in instructor or administrator who is tricked into opening a crafted link.