CVE-2026-105397: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in ThimPress LearnPress

CVE-2026-105397 is a stored cross-site scripting vulnerability in the LearnPress WordPress plugin up to version 4.4.9.1. The flaw allows authenticated instructors to submit unsanitized input through the update_question AJAX handler, specifically in the quiz question hint and explanation fields. This input is then executed as script code in the browsers of students taking the affected quizzes, leading to session compromise or other script-based attacks within the student user context.

An attacker with the Instructor role can inject malicious JavaScript code that executes in the browsers of students taking quizzes. This can lead to session hijacking, unauthorized actions on behalf of students, or other client-side attacks. The vulnerability requires authenticated access with Instructor privileges and user interaction (students taking the quiz).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Instructor role permissions to trusted users only and consider disabling quiz features that allow hint and explanation inputs. Monitor vendor channels for official patches or updates addressing this vulnerability.