The LearnPress WordPress plugin up to version 4.4.9.1 contains a stored cross‑site scripting vulnerability. Instructors who are authenticated can submit arbitrary JavaScript payloads in the quiz question hint and explanation fields through the update_question AJAX handler. The payload is persisted and then rendered in the front‑end quiz playback page, causing the malicious script to execute in the browser on every student who takes the quiz.

This flaw affects installations of the LearnPress plugin from ThimPress, version 4.4.9.1 and all earlier releases. Any WordPress site that includes the plugin at or below this version is susceptible because the issue resides in the rendering of quiz metadata.

The CVSS score of 5.1 suggests moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA KEV. An attacker needs only the Instructor role with permission to edit quiz content, a credential typically available on learning platforms. The attack path is straightforward: the instructor crafts a malicious script, submits it via the AJAX endpoint, and the script subsequently runs in every student’s quiz session. While no public exploitation evidence is reported, the ease of injection and the fact that the script executes in users’ browsers make the risk realistic for affected sites.