The LearnPress plugin contains a stored cross‑site scripting flaw that allows any authenticated user with Contributor or higher privileges to inject malicious JavaScript through the 'skin' attribute of the learn_press_courses shortcode. The value entered is incorporated directly into HTML attributes without sanitization, so the script executes in the browsers of every visitor to pages that contain the malicious shortcode, enabling session hijacking, defacement, or other client‑side attacks.

All installations of the LearnPress WordPress LMS Plugin up to and including version 4.3.3 are affected. Users who can edit or create pages containing the learn_press_courses shortcode can insert the vulnerable attribute. Upgrading to any release newer than 4.3.3 removes the vulnerability.

The CVSS base score of 6.4 indicates a medium‑to‑high risk. No exploit probability score is available, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. Because the attack requires authenticated access and involves a widely used WordPress shortcode, it could be exploited opportunistically by anyone with Contributor access or higher, affecting the integrity and confidentiality of users viewing the compromised content.