Stored DOM-Based Cross-Site Scripting Vulnerability in LearnPress Course Review Plugin for WordPress

CVE-2026-118054

What is CVE-2026-118054?

The LearnPress – Course Review plugin for WordPress is susceptible to a Stored DOM-Based Cross-Site Scripting vulnerability. This issue stems from inadequate input sanitization and output escaping in the 'review_title' parameter, allowing authenticated users with subscriber-level access and above to inject malicious scripts. The injected scripts are executed upon an administrator's approval of a review, posing a significant risk to users interacting with compromised pages. Notably, sites configured with auto-approval for previously approved comments may allow attackers to bypass the manual review process, increasing the vulnerability's impact.

References