The LearnPress WordPress plugin versions prior to 4.4.1 contain a reflected XSS vulnerability (CWE-79) due to improper escaping of a search parameter before it is reflected into an HTML attribute. This flaw enables execution of arbitrary scripts in the context of a logged-in instructor or administrator's browser when they open a specially crafted link. No CVSS score or official remediation level is provided, and no known exploits are reported in the wild.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser of a logged-in instructor or administrator. This could lead to session hijacking, privilege escalation, or other malicious actions performed with the victim's privileges within the LearnPress plugin context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 4.4.1, upgrading to version 4.4.1 or later (once confirmed by the vendor) is recommended. Until a patch is confirmed, avoid clicking on untrusted links and limit exposure of instructor and administrator accounts to potentially malicious URLs.