CVE-2026-109208

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'quantity REST / ordercomments checkout' parameter in all versions up to, and including, 4.4.10 due to insufficient input sanitization and output...

EUVD-2026-103216

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'quantity REST / ordercomments checkout' parameter in all versions up to, and including, 4.4.10 due to insufficient input sanitization and output...

CVE-2026-109208

The LearnPress – WordPress LMS Plugin is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 4.4.10 . The root cause is insufficient input sanitization and output escaping within the 'quantity (REST)' and 'order_comments (checkout)' parameters. This allows an attacker ...

CVE-2026-109208 LearnPress <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' Parameters

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'quantity REST / ordercomments checkout' parameter in all versions up to, and including, 4.4.10 due to insufficient input sanitization and output...

CVE-2026-109208 LearnPress <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' Parameters

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'quantity REST / ordercomments checkout' parameter in all versions up to, and including, 4.4.10 due to insufficient input sanitization and output...

CVE-2026-109208: Improper Neutralization of Input During Web Page Generation

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'quantity REST / ordercomments checkout' parameter in all versions up to, and including, 4.4.10 due to insufficient input sanitization and output...

ThimPress LearnPress Cross-Site Script Vulnerabilities

ThimPress and LearnPress versions 4.4.10 and earlier have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning for parameters like quantity REST and ordercomments checkout, as well as improper output escaping. It may lead to stored cross-site scripting...