CVE-2026-105397
Received Received - Intake

Stored XSS in LearnPress WordPress Plugin

Publication date: 2026-10-05

Last updated on: 2026-10-05

Assigner: VulnCheck

Description
LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role can submit unsanitized payloads through the update_question AJAX handler that execute in the session of every student taking the quiz.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-05
Last Modified
2026-10-05
Generated
2026-10-05
AI Q&A
2026-10-05
EPSS Evaluated
N/A
NVD
CVE-2026-105397
EUVD
EUVD-2026-92444

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ThimPress LearnPress 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in the LearnPress WordPress plugin up to version 4.4.9.1. Authenticated instructors can inject malicious scripts via unsanitized quiz question hint and explanation fields. These payloads execute in the browser of every student taking the quiz.

Detection Guidance

To detect this vulnerability, check if the LearnPress plugin version is 4.4.9.1 or earlier. Inspect quiz question hints and explanations for unsanitized scripts. Review server logs for suspicious AJAX update_question requests from instructor accounts.

Impact Analysis

Attackers with the Instructor role can steal session cookies, redirect users to malicious sites, or perform actions on behalf of users. Students viewing quiz content may have their sessions compromised without any action required on their part.

Compliance Impact

This XSS vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles. For HIPAA, it may expose protected health information if quiz content includes such data, risking compliance with safeguard requirements.

Mitigation Strategies

Update LearnPress to the latest patched version immediately. Remove unsanitized scripts from existing quiz hints and explanations. Restrict instructor role permissions to prevent unauthorized access. Monitor for unusual activity in quiz interactions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105397. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart