The vulnerability is a stored cross‑site scripting flaw where the LearnPress plugin fails to properly sanitize or escape the 'quantity' and 'order_comments' parameters. These parameters can be injected with arbitrary scripts that are then persisted and executed whenever a page containing the injected data is rendered. Because the payload is stored, any subsequent visitor to the affected page—regardless of authentication—will run the malicious code, enabling session hijacking, defacement, or delivery of malware. The flaw maps to CWE‑79, reflecting improper output escaping.

All releases of the thimpress LearnPress WordPress LMS plugin up to and including version 4.4.10 are affected. The issue arises in the checkout and order processing components accessible both via the REST API and the traditional WordPress admin UI.

The assigned CVSS base score of 7.2 indicates a high‑to‑medium risk. The EPSS score is unavailable, but the vulnerability is exploitable without authentication when guest checkout is enabled, or by any authenticated Subscriber users otherwise. Because the flaw relies solely on unsanitized input, the attack surface is large and does not require network intrusion; once the attacker injects the payload, any site visitor becomes a victim. The vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread public exploits have been confirmed yet.