PT-2026-31080 · WordPress · Learnpress – Wordpress Lms Plugin

Djaidja Moundjid

·

Published

2026-04-08

·

Updated

2026-04-13

·

CVE-2026-4333

CVSS v3.1

6.4

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions LearnPress – WordPress LMS Plugin versions up to and including 4.3.3
Description The LearnPress – WordPress LMS Plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'skin' attribute of the learn press courses shortcode. This is caused by inadequate input sanitization and output escaping on the 'skin' shortcode attribute. The attribute value is directly used in a sprintf() call to generate HTML (class attribute and data-layout attribute) without proper esc attr() escaping. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages, which will execute when a user accesses the injected page.
Recommendations Update LearnPress – WordPress LMS Plugin to a version beyond 4.3.3.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-4333

Affected Products

Learnpress – Wordpress Lms Plugin