{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3athimpresslearnpresswordpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:thimpress:learnpress:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-109208"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["LearnPress (\u003c= 4.4.10)"],"_cs_severities":["high"],"_cs_tags":["wordpress","xss","web-application-vulnerability"],"_cs_type":"advisory","_cs_vendors":["ThimPress"],"content_html":"\u003cp\u003eThe LearnPress - WordPress LMS Plugin for Create and Sell Online Courses, developed by ThimPress, contains a Stored Cross-Site Scripting (XSS) vulnerability in all versions up to and including 4.4.10. The vulnerability exists due to insufficient sanitization and escaping of user-provided input within the 'quantity' (REST API) and 'order_comments' (checkout) parameters.\u003c/p\u003e\n\u003cp\u003eIf the site administrator has enabled the guest checkout feature, an unauthenticated attacker can exploit this flaw to inject arbitrary malicious web scripts. Even if guest checkout is disabled, any registered user with Subscriber-level privileges can trigger the injection during the checkout process. Once the script is stored, it executes in the browser of any user (such as an administrator or other customers) who accesses the affected checkout or order comment pages. This can lead to account takeover, sensitive data theft, or unauthorized actions performed on behalf of the victim.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the execution of malicious scripts in the context of other users on the WordPress site. In multi-user environments such as LMS platforms, this poses a high risk to administrative sessions and sensitive user data. The impact is significant for organizations relying on LearnPress to manage course transactions and user profiles, as attackers could potentially compromise high-privileged accounts or intercept payment-related comments.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpdate the LearnPress plugin immediately to a version newer than 4.4.10.\u003c/li\u003e\n\u003cli\u003eUntil a patch is applied, disable the guest checkout functionality to restrict the exploit surface to authenticated users.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for suspicious POST requests to the checkout and REST API endpoints that include scripts or HTML tags.\u003c/li\u003e\n\u003cli\u003eImplement a robust Content Security Policy (CSP) to mitigate the impact of XSS attacks by restricting where scripts can be loaded from and executed.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-17T04:48:12Z","date_published":"2026-10-17T04:48:12Z","id":"https://feed.craftedsignal.io/briefs/2026-10-learnpress-xss/","summary":"The LearnPress WordPress plugin is vulnerable to Stored Cross-Site Scripting via the 'quantity' and 'order_comments' parameters, allowing script injection by unauthenticated or low-privileged users.","title":"Stored Cross-Site Scripting in LearnPress WordPress Plugin","url":"https://feed.craftedsignal.io/briefs/2026-10-learnpress-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:thimpress:learnpress:*:*:*:*:*:wordpress:*:*","version":"https://jsonfeed.org/version/1.1"}