CVE-2026-12230: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses

CVE-2026-12230 is a stored cross-site scripting vulnerability in the LearnPress WordPress LMS plugin affecting all versions up to and including 4.3.9.1. The vulnerability exists due to improper neutralization of input in the 'layout_custom_css' parameter, allowing authenticated attackers with contributor-level privileges or above to inject arbitrary web scripts. These scripts execute in the context of users who access the injected pages, potentially leading to session hijacking or other script-based attacks. The CVSS v3.1 base score is 6.4, indicating a medium severity with network attack vector, low attack complexity, and no user interaction required.

An attacker with contributor-level access or higher can exploit this vulnerability to inject malicious scripts into pages via the 'layout_custom_css' parameter. These scripts execute in the browsers of users who visit the compromised pages, potentially leading to information disclosure or session hijacking. The vulnerability does not affect availability but impacts confidentiality and integrity.

No official patch or fix is currently referenced. Users should upgrade beyond version 4.3.9.1 once a fixed version is released. Until then, restrict contributor-level access to trusted users only and consider disabling or limiting use of the 'layout_custom_css' parameter if possible. Monitor vendor advisories for updates and apply official fixes promptly when available.