Cross-Site Scripting in LearnPress Plugin Affects WordPress Websites
CVE-2026-86444
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 16 September 2026
Badges
What is CVE-2026-86444?
The LearnPress plugin for WordPress, prior to version 4.4.7, is susceptible to a Cross-Site Scripting (XSS) vulnerability. This occurs due to the failure to properly escape user-supplied data before embedding it in HTML attributes on public pages. An attacker can exploit this flaw by crafting a malicious link that, when visited by unsuspecting users, including logged-in administrators, executes arbitrary JavaScript in their browsers. This poses a significant risk, especially for websites utilizing a traditional theme instead of a block-based setup.
Affected Version(s)
LearnPress 4.2.6.4 < 4.4.7
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.