CVE-2026-12732
Received Received - Intake

Stored XSS in LearnPress WordPress Plugin

Publication date: 2026-07-01

Last updated on: 2026-07-01

Assigner: Wordfence

Description
The LearnPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class_wrapper_form' shortcode attribute in versions up to, and including, 4.4.0. This is due to insufficient input sanitization and output escaping in the FilterCourseTemplate::sections() method at line 98, where the attacker-controlled attribute is inserted into an HTML class attribute via sprintf('<form class="%s">', $class_wrapper_form) without esc_attr() escaping. The FilterCourseShortcode::render() handler does not apply shortcode_atts() filtering, so raw user attributes flow directly through do_action('learn-press/filter-courses/layout', $data) into the template. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-01
Last Modified
2026-07-01
Generated
2026-07-21
AI Q&A
2026-07-01
EPSS Evaluated
2026-07-20
NVD
CVE-2026-12732
EUVD
EUVD-2026-40934

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
thimpress learnpress to 4.4.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The LearnPress plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 4.4.0. This occurs because the 'class_wrapper_form' shortcode attribute is not properly sanitized or escaped before being inserted into an HTML class attribute. Specifically, the FilterCourseTemplate::sections() method inserts this attribute using sprintf without applying esc_attr() escaping. Additionally, the FilterCourseShortcode::render() handler does not filter shortcode attributes, allowing raw user input to flow directly into the template. As a result, authenticated users with contributor-level access or higher can inject malicious scripts that execute whenever a user views the affected page.

Detection Guidance

Detection of this vulnerability involves identifying if the LearnPress plugin version is 4.4.0 or earlier and checking for the presence of malicious scripts injected via the 'class_wrapper_form' shortcode attribute.

Since the vulnerability allows authenticated users with contributor-level access or higher to inject scripts, monitoring for unusual shortcode attributes or unexpected HTML class attributes in pages generated by LearnPress can help detect exploitation.

Specific commands to detect this vulnerability are not provided in the available resources.

Impact Analysis

This vulnerability allows attackers with contributor-level access or higher to inject arbitrary malicious scripts into pages. These scripts execute in the context of users who visit the infected pages, potentially leading to theft of sensitive information, session hijacking, defacement, or further exploitation of the website. Since the vulnerability is a stored XSS, the malicious code persists on the site and affects all users who access the compromised content.

Mitigation Strategies

Immediate mitigation steps include updating the LearnPress plugin to a version later than 4.4.0 where the vulnerability is fixed.

If an update is not immediately possible, restrict contributor-level and higher user permissions to trusted users only, as the vulnerability requires authenticated access at this level.

Additionally, monitor and sanitize any shortcode attributes manually if possible, and consider disabling the affected shortcode until a patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12732. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart