rootpwn

high · CVSS v3 7.2

CVE-2026-109208

LearnPress LMS plugin for WordPress is vulnerable to stored XSS via the quantity and order_comments parameters. Unauthenticated attackers ca

Overview

LearnPress LMS plugin for WordPress is vulnerable to stored XSS via the quantity and order_comments parameters. Unauthenticated attackers can inject scripts that execute when a user visits an injected page. This flaw affects all versions up to 4.4.10.

Description

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'quantity (REST) / order_comments (checkout)' parameter in all versions up to, and including, 4.4.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. With guest checkout enabled the attack is fully unauthenticated; with guest checkout disabled, any Subscriber-level user can exploit both vectors through their own checkout.

Impact

Confidentiality: attackers can steal session cookies or deface the site. Integrity: injected scripts can alter page content or redirect users. Availability: no direct impact, but user trust may be eroded. Defenders: site administrators, checkout users, and site visitors are impacted.

Remediation

Upgrade LearnPress to the latest version (≥4.4.11). Disable guest checkout if not needed. Ensure input sanitization and output escaping for quantity and order_comments fields. Apply a web application firewall rule to block XSS payloads and monitor logs for suspicious activity.

Risk context

High severity CVE with CVSS 7.2 indicates a significant risk. Immediate patching and mitigation are recommended to prevent script injection attacks.

Affected products

  • LearnPress LMS plugin
  • WordPress LMS plugin
  • LearnPress 4.4.10
  • WordPress plugin
  • Create and Sell Online Courses plugin
  • LearnPress plugin

Scores

Severity
high
CVSS v2
6.4
CVSS v3
7.2
CVSS v4
—
EPSS
—

XSS WordPress LearnPress LMS Stored XSS Guest Checkout High Severity

← All CVEs

Related CVEs

high

CVE-2026-111854

An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability in the SCPI FILESystem command interface allows remote attackers to read or modify arbitrary files on the device through insufficient validation of file paths supplied to filesystem access commands.

View analysis

high

CVE-2026-111855

An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability exists in the web management interface of the device. Insufficient validation of user-supplied file paths allows remote attackers to read arbitrary files accessible to the application. Depending on configuration, exploitation may be possible without authentication.

View analysis

high

CVE-2026-92798

The User Registration & Membership plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 5.2.8 This is due to insufficient input sanitization in the 'referrer_url' branch of UR_Smart_Tags::process(), where the attacker-controlled HTTP_REFERER header is only passed through sanitize_text_field() — which does not strip WordPress shortcode delimiters — before being substituted into a Content Restriction message that is subsequently executed via apply_shortcodes()/do_shortcode(). This makes it possible for unauthenticated attackers to execute arbitrary registered shortcodes on any restricted page whose message uses the supported {{referrer_url}} smart tag.

View analysis

high

CVE-2026-96660

The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Checkbox Field Value in all versions up to, and including, 5.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nopriv AJAX action user_registration_user_form_submit reaches ur_process_registration() without nonce validation, meaning any unauthenticated request can reach the vulnerable code path.

View analysis