Stored Cross-Site Scripting Vulnerability in LearnPress Plugin for WordPress

CVE-2026-105397

What is CVE-2026-105397?

CVE-2026-105397 is a stored cross-site scripting (XSS) vulnerability found in the LearnPress plugin for WordPress, specifically in versions up to 4.4.9.1. LearnPress is a widely-used plugin that enables educators and institutions to create and sell online courses through WordPress. This vulnerability allows authenticated users with the Instructor role to inject malicious scripts into quiz question hint and explanation fields. When these scripts are executed, they run in the context of all students participating in the quizzes, potentially leading to various security issues.

The nature of this vulnerability stems from the unsanitized payloads submitted through the update_question AJAX handler. This lack of proper input validation means that any scripts injected by instructors can execute in the browsers of students taking the quizzes, compromising their sessions and providing attackers with opportunities for malicious activities.

Potential impact of CVE-2026-105397

1. Session Hijacking: By leveraging the XSS vulnerability, attackers can hijack user sessions, gaining unauthorized access to sensitive information or accounts of students participating in quizzes, potentially leading to further exploitation.

2. Malicious Redirection: The injected scripts could be used to redirect students to phishing sites or other malicious domains, compromising their personal information and credentials.

3. Reputation Damage: Organizations using the LearnPress plugin could face reputational harm if students' data or experiences are compromised due to the exploitation of this vulnerability, impacting trust and leading to a decline in user engagement.

References