CVE-2026-105397 in LearnPress Plugin
Summary
by MITRE • 10/05/2026
LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role can submit unsanitized payloads through the update_question AJAX handler that execute in the session of every student taking the quiz.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/05/2026
The LearnPress plugin for WordPress, specifically versions up to 4.4.9.1, contains a critical stored cross-site scripting vulnerability within its educational management infrastructure. This flaw arises from insufficient input validation and output encoding mechanisms when handling user-supplied data in specific administrative interfaces. The vulnerability is located in the quiz question hint and explanation fields, which are intended for instructional content but lack proper sanitization before being processed by the backend systems. Because these fields are part of a persistent storage mechanism, any malicious script injected into them remains stored on the server until explicitly removed or overwritten. This persistence distinguishes it from reflected XSS attacks, as the payload does not need to be triggered via a specific link or immediate request but is instead served dynamically whenever the affected content is accessed by legitimate users.
The operational impact of this vulnerability is significant due to the privilege level required for exploitation and the scope of potential victims. An attacker must possess at least the Instructor role within the WordPress environment, which grants them permission to create and modify quiz questions. Once authenticated with these privileges, an adversary can submit unsanitized JavaScript payloads through the update_question AJAX handler. This specific endpoint processes the input without adequate filtering, allowing arbitrary code execution in the context of any student who subsequently views or takes a quiz containing the compromised question. The attack vector is particularly insidious because it targets students who are typically trusted users with varying levels of security awareness, potentially leading to widespread compromise across an educational institution's user base.
From a technical perspective, this vulnerability aligns closely with CWE-79, which classifies improper neutralization of input during web page generation as the root cause. The failure lies in the application logic that fails to escape special characters or validate script tags before storing them in the database and subsequently rendering them in HTML contexts without proper encoding. This allows client-side scripts to execute within the browser environment of the victim, bypassing same-origin policy protections because the malicious code originates from a trusted domain. The use of an AJAX handler for updating question data further complicates mitigation efforts if developers rely solely on frontend validation, as server-side checks are essential to prevent such injections regardless of how the request is initiated.
The security implications extend beyond simple script execution and encompass broader risks associated with session hijacking and credential theft. By injecting scripts that exfiltrate cookies or local storage data, an attacker can capture authentication tokens used by students to access their accounts. This could lead to unauthorized access to personal information, academic records, or even administrative functions if the victim holds higher privileges. Furthermore, the injected script could redirect users to phishing sites designed to steal login credentials under the guise of a system alert or quiz error message. In enterprise environments where LearnPress is used for corporate training, this vulnerability poses a risk to internal networks and sensitive organizational data stored within user sessions.
To mitigate this vulnerability, immediate action should be taken by upgrading the LearnPress plugin to version 4.5.0 or later, where these input validation issues have been addressed. For organizations unable to upgrade immediately due to compatibility constraints with other plugins or custom code modifications, implementing a Web Application Firewall rule can provide temporary protection by detecting and blocking requests containing common XSS payloads in quiz-related AJAX endpoints. Additionally, developers should enforce strict output encoding on all dynamic content rendered from the database, particularly within HTML attributes and script blocks. Adopting Content Security Policy headers that restrict inline script execution can also serve as an effective defense-in-depth measure, preventing malicious scripts from running even if they are successfully injected into the DOM. Regular security audits of custom WordPress plugins and adherence to OWASP guidelines for input validation will further reduce the risk of similar vulnerabilities in future development cycles.