CVE-2026-105397: medium-severity vulnerability in ThimPress LearnPress
LearnPress WordPress Plugin through 4.4.9.1 Stored XSS via Quiz Question Hint and Explanation
Published · Updated
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.1epss 0.2%
exploitation probability
0.2%top 94% of all CVEs
observed exploitation
nono source reports it
LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role can submit unsanitized payloads through the update_question AJAX handler that execute in the session of every student taking the quiz.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Affected products
ThimPress · LearnPressRelated CVEs — ThimPress LearnPress
In the same product, most dangerous first.
CVE-2018-16175—CVE-2018-16175EPSS 1.3%CVE-2018-16174—CVE-2018-16174EPSS 1.0%CVE-2018-16173—CVE-2018-16173EPSS 1.0%CVE-2023-36516HIGHWordPress LearnPress plugin <= 4.2.3 - Authenticated Broken Access Control vulnerabilityEPSS 0.5%CVE-2023-36515HIGHWordPress LearnPress plugin <= 4.2.3 - Unauthenticated Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-39642MEDIUMWordPress LearnPress plugin <= 4.2.6.8.2 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.4%
References
https://github.com/LearnPress/learnpress/commit/9db279c0d9fd3993430bb9af158658282e9bcee1https://plugins.svn.wordpress.org/learnpress/tags/4.4.9.1/assets/src/apps/js/frontend/quiz/components/questions/question.jshttps://plugins.svn.wordpress.org/learnpress/tags/4.4.9.1/inc/Ajax/EditQuestionAjax.phphttps://wordpress.org/plugins/learnpress/https://www.vulncheck.com/advisories/learnpress-wordpress-plugin-through-4.4.9.1-stored-xss-via-quiz-question-hint-and-explanation