Stored Cross-Site Scripting Vulnerability in LearnPress WordPress LMS Plugin

CVE-2026-109208

What is CVE-2026-109208?

The LearnPress plugin for WordPress is susceptible to a Stored Cross-Site Scripting issue. This vulnerability arises from inadequate input sanitization and output escaping in parameters like 'quantity (REST)' and 'order_comments (checkout)'. An unauthenticated attacker can exploit this flaw to inject arbitrary web scripts, which would execute when users visit the affected pages. When guest checkout is activated, the attack can occur without authentication; when disabled, any user with Subscriber-level access can leverage the vulnerability during their own checkout process, placing user data at risk.

References