Skip to content
Threat Feed
Subscribe

Product

LearnPress (<= 4.4.10)

2 briefs RSS
high advisory

Stored Cross-Site Scripting in LearnPress WordPress Plugin

The LearnPress WordPress plugin is vulnerable to Stored Cross-Site Scripting via the 'quantity' and 'order_comments' parameters, allowing script injection by unauthenticated or low-privileged users.

LearnPress wordpress xss web-application-vulnerability
1t 1c
critical advisory

CVE-2026-104736: PHP Object Injection in LearnPress WordPress Plugin

The LearnPress plugin for WordPress is vulnerable to unauthenticated PHP Object Injection via the 'checkout-email' parameter, allowing remote attackers to trigger insecure deserialization.

LearnPress web-vulnerability php-deserialization wordpress cve-2026-104736
1r 2t 1c