LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject… (CVE-2026-105397)

CVE-2026-105397 describes a stored cross-site scripting vulnerability in the LearnPress WordPress plugin through version 4.4.9.1. The flaw allows authenticated instructors to submit unsanitized script payloads through the update_question AJAX handler, specifically targeting the quiz question hint and explanation fields. When students take the affected quizzes, the injected scripts execute in their browser sessions, leading to potential session hijacking or other client-side impacts. The vulnerability has a CVSS 3.1 base score of 5.4 (medium severity), with network attack vector, low attack complexity, requiring privileges of an authenticated instructor, and user interaction needed. The impact includes limited confidentiality and integrity loss but no availability impact.

An attacker with the Instructor role can inject malicious scripts that execute in the browser sessions of students taking quizzes. This can lead to session hijacking or unauthorized actions performed in the student's context. The confidentiality and integrity of student data may be partially compromised. There is no direct impact on system availability. The vulnerability requires authenticated access with the Instructor role and user interaction (students taking quizzes).

No vendor advisory or patch information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict Instructor role permissions to trusted users only and consider monitoring or limiting quiz question content inputs. Avoid exposing quiz content to untrusted instructors. Implementing web application firewall (WAF) rules to detect and block script injection attempts may provide temporary mitigation.