LearnPress <= 4.4.7 - Reflected Cross-Site Scripting via 'orderby' Parameter
- ID
- WPSEC-2026-0199
- Plugin
- LearnPress – WordPress LMS Plugin for Create and Sell Online Courses (learnpress)
- Affected
- from 4.2.6.9.1 before 4.4.8
- Remediation
- Update to 4.4.8 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- LearnPress on WPSec AttackSurface
- Fix released
- Published
Also published later by Wordfence as CVE-2026-92538, on 2026-10-02.
Description
The LearnPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'orderby' and 'order' parameters (and the 'post_mime_type' and 'detached' parameters) on its admin course, lesson, quiz, question and order list screens in versions 4.2.6.9.1 up to, and including, 4.4.7. The parameters were attribute-escaped into the author-search field markup, but LP_Helper::print_inline_script_tag() then decoded HTML entities in that markup before passing it to the page, and the admin script inserts it with insertAdjacentHTML when the list has no search box (for example, when the filtered list is empty). This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute if they can trick an administrator or instructor into opening a crafted link.
References
- https://wpsec.com/vuln/WPSEC-2026-0199/
- https://plugins.svn.wordpress.org/learnpress/tags/4.4.8/
- https://wordpress.org/plugins/learnpress/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS