CVE-2026-4333 is a stored cross-site scripting vulnerability in the LearnPress WordPress LMS plugin affecting all versions up to 4.3.3. The issue arises because the 'skin' attribute of the learn_press_courses shortcode is used directly in an sprintf() call to generate HTML class and data-layout attributes without esc_attr() escaping. This allows authenticated users with Contributor or higher privileges to inject arbitrary JavaScript that executes in the context of users visiting the compromised pages.

Successful exploitation allows an attacker with Contributor-level or higher access to inject persistent malicious scripts into pages generated by the plugin. These scripts execute in the browsers of users who view the affected pages, potentially leading to session hijacking, unauthorized actions, or other client-side impacts. The vulnerability does not affect availability and requires authenticated access, limiting its scope.

Patch status is not yet confirmed—no official fix or patch links are provided. Users should monitor the vendor's advisory for updates and apply any official patches once available. Until then, restrict Contributor-level access to trusted users only and consider disabling or limiting use of the 'skin' attribute in the shortcode if possible to reduce risk.