Stored Cross-Site Scripting Vulnerability in LearnPress Plugin for WordPress

CVE-2026-12732

What is CVE-2026-12732?

The LearnPress plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability through the 'class_wrapper_form' shortcode attribute. This occurs in versions up to and including 4.4.0, where inadequate input sanitization and output escaping allows attacker-controlled attributes to be embedded in an HTML class attribute. Specifically, the vulnerability resides in the FilterCourseTemplate::sections() method, where an unfiltered input is passed directly to the template, enabling authenticated users with contributor-level access or higher to inject malicious scripts into pages. Consequently, these scripts can execute when other users visit the affected pages, posing significant security risks.

References