CVE-2026-12732 is a stored cross-site scripting vulnerability in the LearnPress WordPress LMS plugin (up to version 4.4.0). The issue occurs because the 'class_wrapper_form' shortcode attribute is inserted directly into an HTML class attribute without proper escaping (missing esc_attr()), specifically in the FilterCourseTemplate::sections() method. Additionally, the FilterCourseShortcode::render() handler does not filter shortcode attributes, allowing raw user input to flow into the template. This enables authenticated attackers with contributor-level permissions or higher to inject arbitrary JavaScript that executes in the context of users viewing the injected pages.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable shortcode attribute. These scripts execute in the browsers of users who visit the affected pages, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability does not impact availability but affects confidentiality and integrity of user sessions and data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and avoid using the vulnerable shortcode attribute. Monitor vendor channels for updates and apply official patches promptly once released.