Stored Cross-Site Scripting in LearnPress WordPress LMS Plugin
CVE-2025-14387
6.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 15 December 2025
What is CVE-2025-14387?
The LearnPress WordPress LMS Plugin is susceptible to Stored Cross-Site Scripting (XSS) vulnerabilities, impacting all versions up to and including 4.3.1. This flaw arises from inadequate input sanitization and output escaping, permitting authenticated attackers with Subscriber-level access and higher to inject arbitrary web scripts. These scripts are executed whenever users open an affected page, potentially compromising sensitive user data and affecting overall website integrity.
Affected Version(s)
LearnPress – WordPress LMS Plugin * <= 4.3.1