Description

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'layout_custom_css' parameter in all versions up to, and including, 4.3.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-08T12:16:50.620Z",
  "pubdate": "2026-09-08T12:16:50.620Z",
  "executiveSummary": "The LearnPress WordPress LMS plugin is affected by a Stored Cross-Site Scripting (XSS) vulnerability originating from the improper handling of user-supplied data. This security flaw exists in versions up to and including 4.3.9.1.\nThe vulnerability allows an authenticated attacker possessing contributor-level privileges or higher to inject arbitrary malicious JavaScript into the application. When a victim, such as an administrator or another user, views the affected page, the malicious script executes within the context of their session.\nThe impact is significant, as successful exploitation enables attackers to compromise user accounts, hijack sessions, redirect users to malicious domains, or perform unauthorized administrative actions on behalf of the victim. The flaw stems from insufficient input sanitization and output escaping mechanisms within the 'layout_custom_css' parameter. Given the requirement for authentication, the primary threat vector involves internal users or compromised accounts escalating their impact through script injection. Immediate remediation is required to prevent unauthorized script execution.",
  "technicalDetails": "The vulnerability is classified as Stored Cross-Site Scripting (XSS), which occurs when an application receives data from an untrusted source and includes that data within its later HTTP responses without proper validation or encoding. In this instance, the vulnerable component is the 'layout_custom_css' parameter within the LearnPress plugin.\nThe root cause of this vulnerability is the failure of the plugin to perform adequate input sanitization on the 'layout_custom_css' parameter before storing it in the database. Furthermore, the application fails to implement context-aware output escaping when rendering this stored value back to the browser. Consequently, user-supplied content that contains malicious JavaScript payloads is treated as executable code by the victim's browser.\nExploitation requires the attacker to hold at least Contributor-level access. An attacker can navigate to the settings or configuration interface where the 'layout_custom_css' parameter is processed. By supplying a crafted CSS or HTML payload containing script tags (e.g., <script>alert(document.cookie)</script>) or event-based JavaScript handlers (e.g., onload, onerror), the attacker forces the application to save the malicious string into the database.\nThe attack flow is as follows: 1) The authenticated attacker submits a malicious script via the 'layout_custom_css' field. 2) The server accepts the input without filtering out potentially hazardous HTML/JavaScript elements. 3) The malicious payload is persisted in the database. 4) When an unsuspecting user navigates to the specific page where this CSS is rendered, the web application serves the stored, unsanitized payload. 5) The browser interprets the injected script and executes it within the security context of the victim's session.\nThe post-exploitation impact allows the attacker to achieve full unauthorized client-side control. This includes the theft of sensitive session cookies, CSRF token exfiltration, manipulation of the Document Object Model (DOM) to display fake login forms, or the automated execution of administrative actions without the user's consent. Because the script executes in the context of the user who views the page, an attacker could specifically target administrators to facilitate site-wide compromise or escalation of privileges."
}