Description

LearnPress WordPress Plugin before 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers with the Instructor role to inject persistent malicious payloads by submitting unsanitized input into quiz question answer title fields. Attackers can store arbitrary JavaScript through the answer title parameter, which is rendered through an unescaped HTML sink to execute in the browsers of any user who views the affected quiz question, including students, other instructors, and administrators.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-03T18:17:24.410Z",
  "pubdate": "2026-09-03T18:17:24.410Z",
  "executiveSummary": "LearnPress WordPress Plugin versions prior to 4.4.6 are susceptible to a stored Cross-Site Scripting (XSS) vulnerability. The flaw resides in the quiz management functionality, where improper sanitization of input fields allows authenticated users with the Instructor role to inject arbitrary JavaScript payloads. By inserting malicious scripts into quiz question answer titles, an attacker can ensure the execution of these scripts within the browser sessions of any user who subsequently views the compromised quiz content. This includes students, fellow instructors, and administrative personnel, effectively compromising their session data or executing unauthorized actions on their behalf. The vulnerability is classified as a stored (persistent) XSS, posing a significant risk to the integrity and confidentiality of the WordPress environment. The primary attack vector requires an attacker to possess Instructor-level privileges to interact with the vulnerable input parameters. Successful exploitation necessitates that the victim interacts with the malicious content, making it an effective vector for session hijacking, unauthorized administrative actions, and broader site-wide impact if an administrator views the tainted quiz question.",
  "technicalDetails": "The vulnerability originates from the failure of the LearnPress plugin to perform adequate input validation and output encoding on the 'answer title' parameter associated with quiz questions. In WordPress development, it is imperative that all user-supplied data be sanitized upon input and escaped upon output to prevent malicious scripts from being interpreted as active content by the browser. In this instance, the plugin developers failed to apply these security controls to the quiz question answer title field.\nThe root cause is an unescaped HTML sink that processes user-controlled data. When an authenticated user with the Instructor role saves a quiz question, the application accepts the input and persists it directly into the database. When a target user (e.g., student, admin) accesses the affected quiz, the application retrieves the malicious payload from the database and renders it into the DOM without prior sanitization. Consequently, the browser interprets the injected JavaScript as legitimate code rather than plaintext.\nThe exploitation flow follows a precise sequence: First, an attacker authenticates as an Instructor. Second, the attacker navigates to the quiz creation or modification interface. Third, the attacker inputs a malicious JavaScript payload into the 'answer title' field. Fourth, the server stores this payload in the database. Fifth, any user with permission to view the quiz inadvertently triggers the stored script when the browser parses the unescaped answer title. The script then executes within the security context of the victim's session.\nThis vulnerability is particularly severe because the payload persists indefinitely in the application's backend until the database entry is manually cleaned or the vulnerability is patched. Because the script executes in the context of any viewing user, an attacker can target high-privilege accounts (such as Administrators) to perform cross-site request forgery (CSRF), exfiltrate sensitive cookies, or redirect users to malicious third-party domains. Since the vulnerability is dependent on the Instructor role, it effectively bypasses standard low-level user restrictions, leveraging a trusted account level to deliver the malicious payload. The lack of output encoding within the specific quiz answer title rendering function remains the core architectural weakness in affected versions prior to 4.4.6."
}