Description
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'layout_custom_css' parameter in all versions up to, and including, 4.3.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2026-09-08
Score: 6.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Stored Cross‑Site Scripting that allows authenticated users to inject scripts into pages
Action: Immediate Patch
AI Analysis

Impact

The LearnPress WordPress LMS plugin is vulnerable to a stored XSS flaw caused by insufficient sanitization of the 'layout_custom_css' parameter. This weakness (CWE‑79) means that an authenticated user with contributor‑level access or higher can persistently inject arbitrary web scripts that execute when a user visits a page rendering the custom CSS.

Affected Systems

WordPress sites that use LearnPress versions 4.3.9.1 or earlier are affected. The flaw exists in all versions up to and including 4.3.9.1 and is tied to the plugin’s layout_custom_css handling.

Risk and Exploitability

The vulnerability carries a CVSS score of 6.4, indicating a moderate severity and a moderate likelihood of exploitation. Because the EPSS score is not available and the CVE is not listed in the CISA KEV catalog, there is no current evidence of widespread exploitation. The likely attack vector is an authenticated user with contributor permissions, which is a relatively common role on many WordPress installations. The flaw would allow the attacker to inject client‑side scripts that could deface content, steal user‑session data, or perform phishing attempts against site visitors.

Generated by OpenCVE AI on September 8, 2026 at 12:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the LearnPress plugin to version 4.4.0 or later where the 'layout_custom_css' handling has been fixed
  • If an upgrade is not immediately feasible, remove or disable the 'layout_custom_css' feature for contributor and lower roles, or add a role‑based restriction that prevents those users from submitting custom CSS
  • Implement content‑security‑policy headers to mitigate the impact of any unfiltered JavaScript that may still be injected
  • Review and harden input validation and output escaping throughout the plugin to prevent similar issues in future updates

Generated by OpenCVE AI on September 8, 2026 at 12:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 09 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 08 Sep 2026 14:15:00 +0000

Type Values Removed Values Added
First Time appeared Thimpress
Thimpress learnpress – Wordpress Lms Plugin For Create And Sell Online Courses
Wordpress
Wordpress wordpress
Vendors & Products Thimpress
Thimpress learnpress – Wordpress Lms Plugin For Create And Sell Online Courses
Wordpress
Wordpress wordpress

Tue, 08 Sep 2026 11:45:00 +0000

Type Values Removed Values Added
Description The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'layout_custom_css' parameter in all versions up to, and including, 4.3.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Title LearnPress <= 4.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'layout_custom_css'
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}

Subscriptions

Thimpress Learnpress – Wordpress Lms Plugin For Create And Sell Online Courses
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-09-09T16:00:38.044Z

Reserved: 2026-06-14T21:37:29.728Z

Link: CVE-2026-12230

cve-icon Vulnrichment

Updated: 2026-09-09T16:00:29.111Z

cve-icon NVD

Status : Deferred

Published: 2026-09-08T12:16:50.620

Modified: 2026-09-09T17:17:15.610

Link: CVE-2026-12230

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-08T14:00:18Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')