Security Alert Summary
The LearnPress plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability that affects versions through 4.4.9.1. Authenticated users with the Instructor role can submit unsanitized input in quiz question fields that is stored and later executed in the browsers of students taking those quizzes.
CVE Details
- CVE ID: CVE-2026-105397
- Affected component: LearnPress plugin for WordPress (vendor: ThimPress)
- Affected versions: Versions through 4.4.9.1 (as reported)
- Published: October 5, 2026 at 4:17:12 PM
- Last modified: October 5, 2026 at 4:17:12 PM
- CVSS v3.1: Base score 5.4, MEDIUM; Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Authentication / privileges / user interaction:
- Attack requirements: NONE (per CVSS v4.0 data)
- Privileges required: LOW
- User interaction: REQUIRED
- Primary impact: Confidentiality: LOW; Integrity: LOW; Availability: NONE
- CWE / weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-site Scripting)
Technical Details
This is a stored cross-site scripting vulnerability in LearnPress that allows authenticated instructors to inject script payloads into quiz question fields (specifically the hint and explanation fields). The vulnerability exists because input submitted to the update_question AJAX handler is not properly sanitized before being stored and later rendered to students.
When an Instructor submits unsanitized content through the update_question handler, that content can be stored and then executed in the browser session of any student taking the affected quiz. The description and metadata indicate the injection occurs in the quiz question hint and explanation fields and is processed by the plugin update flow for questions.
The impact is limited to the capabilities of scripts running in a student browser context: any action that a malicious script can perform in the students browser (for example, reading rendered page content or acting on behalf of the student in that session) may be possible. The report does not indicate escalation to administrator-level actions or direct server-side compromise.
How This Could Impact Your Website
Consider a typical small training site where the site owner manages courses, internal staff create content, and an external contractor or contributor is granted Instructor access to add or edit quizzes. If an Instructor account submits malicious script into a question hint or explanation, every student who loads that quiz may execute the script in their browser. Practical consequences include exposure of information visible to the student session, unwanted modifications to the quiz experience, and increased risk of targeted phishing or social engineering against students and staff.
For example, a malicious script could display deceptive prompts that trick students into revealing contact information, or it could harvest values visible in the quiz interface. While the reported impact is confined to confidentiality and integrity at a low level (and does not indicate availability loss), the exposure of student-facing data and the potential for targeted social engineering are real concerns.
If you\’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially Instructor and Contributor accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and themes.
- Monitor site activity, audit recent changes to quizzes, and watch for unusual behavior in instructor accounts or quiz content.
If you\’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://github.com/LearnPress/learnpress/commit/9db279c0d9fd3993430bb9af158658282e9bcee1
- https://plugins.svn.wordpress.org/learnpress/tags/4.4.9.1/assets/src/apps/js/frontend/quiz/components/questions/question.js
- https://plugins.svn.wordpress.org/learnpress/tags/4.4.9.1/inc/Ajax/EditQuestionAjax.php
- https://wordpress.org/plugins/learnpress/
- https://www.vulncheck.com/advisories/learnpress-wordpress-plugin-through-4.4.9.1-stored-xss-via-quiz-question-hint-and-explanation
