CVE-2026-92538 is a reflected DOM-based cross-site scripting vulnerability in the LearnPress WordPress LMS plugin affecting all versions up to 4.4.7. The flaw is due to improper neutralization of input in the 'orderby' parameter, enabling attackers to inject malicious scripts that execute in the context of the victim's browser when they click on a manipulated link. This vulnerability requires user interaction but no authentication.

Successful exploitation can lead to the execution of arbitrary scripts in the victim's browser, potentially resulting in information disclosure and limited integrity impact. The CVSS 3.1 score is 6.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and partial confidentiality and integrity impact without availability impact.

No official patch or fix is currently referenced. Users should monitor the vendor's advisories for updates. In the meantime, avoid clicking on suspicious links containing manipulated 'orderby' parameters and consider applying web application firewall rules to detect and block malicious input patterns targeting this parameter.