CVE-2026-82024: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in ThimPress LearnPress

CVE-2026-82024 is a stored cross-site scripting vulnerability in the LearnPress WordPress Plugin prior to version 4.4.6. The flaw arises because input submitted by authenticated users with the Instructor role into quiz question answer title fields is not properly sanitized. This allows attackers to inject arbitrary JavaScript code that is stored and later rendered unescaped in the HTML output. When other users view the affected quiz question, the malicious script executes in their browsers, potentially leading to session hijacking or other client-side attacks.

The vulnerability enables authenticated Instructor role users to execute arbitrary JavaScript in the browsers of other users who view the affected quiz questions. This can lead to unauthorized actions performed on behalf of users, theft of sensitive information, or other client-side attacks. The impact is limited to users who have access to the affected quiz content.

A fix is available in LearnPress version 4.4.6. Users should upgrade to version 4.4.6 or later to remediate this vulnerability. Until patched, restrict Instructor role permissions or avoid using quiz question answer title fields for untrusted input.