CVE-2026-12732: LearnPress WordPress Plugin Stored XSS Vulnerability (v4.4.0)

Technical summary

The vulnerability exists in the FilterCourseTemplate::sections() method (line 98), where user-supplied shortcode attributes are inserted directly into HTML class attributes without proper escaping. The vulnerable code pattern is sprintf('<form class="%s">', $class_wrapper_form), which fails to use WordPress's esc_attr() function. Additionally, the FilterCourseShortcode::render() handler does not call shortcode_atts() to filter and normalize user input, allowing raw attribute values to flow through the do_action('learn-press/filter-courses/layout', $data) hook directly into template rendering. This combination of missing input validation and output encoding creates a persistent XSS condition exploitable by authenticated users.

Business impact

Organizations relying on LearnPress for course delivery face content integrity and user safety risks. Attackers can modify course pages to harvest credentials, inject phishing links, or redirect users to malicious sites. Instructors' or administrator accounts could be compromised if their session tokens are stolen via injected scripts. Compromised courses may erode user trust and trigger compliance issues if personal or learning data is exposed. The vulnerability requires authentication, limiting the attacker pool but not eliminating organizational risk if contributor access is widely distributed or if account credentials are compromised.

Affected systems

LearnPress plugin versions through 4.4.0 are vulnerable. Any WordPress installation running an affected version with the plugin active is at risk. The vulnerability requires the attacker to possess at least contributor-level WordPress user role, meaning only organizations with multiple content creators, instructors, or course authors are exposed. Single-administrator WordPress sites with restricted user creation face lower exposure.

Exploitability

Exploitation requires authenticated access with contributor permissions or above—a moderate barrier in many organizations but a low barrier in educational or multi-author environments where course content is created by many staff members. No user interaction is needed from victims; the injected script executes automatically upon page load. The vulnerability is stored, meaning a single malicious shortcode attribute compromises the page indefinitely until patched or manually removed. Proof-of-concept exploitation would be straightforward for anyone with technical familiarity, though CVSS 3.1 rates it MEDIUM (6.4) because authentication is required.

Remediation

Update LearnPress to the first patched version available after 4.4.0—verify the exact version number in the vendor's security advisory. Additionally, audit all published courses and pages using the 'class_wrapper_form' shortcode attribute for suspicious or unfamiliar values. Review WordPress user roles and consider temporarily restricting contributor access to non-trusted staff until the plugin is patched. Clear any browser caches and conduct a security review of user sessions if the vulnerability was active in production.

Patch guidance

Visit the LearnPress plugin repository or vendor advisory to obtain the patched version. Test the update in a staging environment first to ensure compatibility with your theme and other plugins. After deployment, verify that existing course shortcodes with the 'class_wrapper_form' attribute still render correctly. Monitor logs for any failed updates or installation errors. Document the patching date and version for audit compliance.

Detection guidance

Scan your WordPress plugin directory to confirm the installed LearnPress version. Review database exports or page content for shortcode instances containing 'class_wrapper_form' attributes with unusual characters, JavaScript keywords (e.g., 'onload', 'onclick'), or encoded payloads. Check WordPress audit logs (if logging is enabled) for recent edits to pages containing LearnPress shortcodes by contributor-level users. Monitor front-end page rendering for unexpected JavaScript execution or console errors. Use a Web Application Firewall (WAF) to log and potentially block requests containing common XSS patterns in shortcode attributes.

Why prioritize this

Although CVSS 6.4 (MEDIUM) indicates moderate severity, the stored nature of this XSS, combined with the broad educational and training use case of LearnPress, warrants prompt patching. Compromise of learning platforms can expose sensitive training content or student data. Educational institutions and corporate training organizations should prioritize this patch within their regular monthly cycle to minimize the window of exposure to insider threats or compromised contributor accounts.

Risk score, explained

CVSS 3.1 assigns a score of 6.4 (MEDIUM) because the attack requires network access (AV:N), low attack complexity (AC:L), and authenticated, low-privilege access (PR:L, UI:N). Impact is limited to confidentiality and integrity (C:L, I:L) with no availability impact (A:N), and the scope is changed (S:C), affecting other users' sessions or content. The moderate rating reflects that internal or trusted users must initiate the attack, but once active, the vulnerability affects all page visitors. Organizations with strict access controls or small contributor bases may perceive risk as lower; those with many course authors or distributed permissions should treat it as higher priority.

Frequently asked questions