EUVD-2026-103216

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'quantity REST / ordercomments checkout' parameter in all versions up to, and including, 4.4.10 due to insufficient input sanitization and output...

CVE-2026-109208 LearnPress <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' Parameters

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'quantity REST / ordercomments checkout' parameter in all versions up to, and including, 4.4.10 due to insufficient input sanitization and output...

CVE-2026-109208

The LearnPress – WordPress LMS Plugin is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 4.4.10 . The root cause is insufficient input sanitization and output escaping within the 'quantity (REST)' and 'order_comments (checkout)' parameters. This allows an attacker ...

CVE-2026-109208 LearnPress <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' Parameters

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'quantity REST / ordercomments checkout' parameter in all versions up to, and including, 4.4.10 due to insufficient input sanitization and output...

PT-2026-116352

Name of the Vulnerable Software and Affected Versions LearnPress versions prior to 4.4.11 Description An unauthenticated attacker can perform PHP Object Injection by sending untrusted input through the checkout-email request parameter during the checkout AJAX action. The input is processed by...

PT-2026-116353

Name of the Vulnerable Software and Affected Versions LearnPress – WordPress LMS Plugin for Create and Sell Online Courses versions prior to 4.4.11 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions...

PT-2026-116199

Name of the Vulnerable Software and Affected Versions LearnPress versions prior to 4.4.11 Description Insufficient input sanitization and output escaping allow for Stored Cross-Site Scripting. This occurs via the quantity parameter in the REST API and the order comments parameter during checkout...

WordPress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by daroo in WordPress Plugin LearnPress versions = 4.4.10...

WordPress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin <= 4.4.10 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin LearnPress versions = 4.4.10...

VulnCheck KEV: CVE-2026-104736

The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of untrusted input from the 'checkout-email' request parameter during the checkout AJAX action. The value is passed through sanitizetextfield, which does not stri...

CVE-2026-104670

Unauthenticated Cross Site Scripting XSS in LearnPress = 4.4.9 versions...

CVE-2026-104670

The LearnPress plugin for WordPress (versions

CVE-2026-104670 WordPress LearnPress plugin <= 4.4.9 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in LearnPress = 4.4.9 versions...

EUVD-2026-93078

Unauthenticated Cross Site Scripting XSS in LearnPress = 4.4.9 versions...

CVE-2026-104670 WordPress LearnPress plugin <= 4.4.9 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in LearnPress = 4.4.9 versions...

PT-2026-106378

Unauthenticated Cross Site Scripting XSS in LearnPress = 4.4.9 versions...

CVE-2026-104670: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in LearnPress = 4.4.9 versions...

CVE-2026-105397

LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role can submit unsanitized payloads through the updatequestion...

CVE-2026-105397

The LearnPress plugin for WordPress (versions through 4.4.9.1 ) is vulnerable to a stored cross-site scripting (XSS) flaw. The root cause is the lack of input sanitization in the update_question AJAX handler , which allows authenticated users with the Instructor role to inject malicious scripts v...

CVE-2026-105397 LearnPress WordPress Plugin through 4.4.9.1 Stored XSS via Quiz Question Hint and Explanation

LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role can submit unsanitized payloads through the updatequestion...