PT-2026-39961 · WordPress · Lifepress

Athiwat Tiprasaharn + 1 · Published 2026-05-12 · Updated 2026-05-12 · CVE-2026-6690

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions LifePress versions prior to 2.2.3

Description The LifePress plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs because the wp ajax nopriv lp update mds function is registered without capability checks or nonce verification (a unique token used to prevent cross-site request forgery), and fails to properly sanitize input and escape output when rendering the series name in the admin settings page. Unauthenticated attackers can exploit this by sending arbitrary web scripts through the 'n' parameter of the 'lp update mds' AJAX action, which then execute when a user visits the affected page.

Recommendations Update the plugin to a version later than 2.2.2. As a temporary workaround, restrict access to the 'lp update mds' AJAX action or the 'n' parameter until the update is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-6690

Affected Products

Lifepress

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-6690 · Security Note
• https://plugins.trac.wordpress.org/browser/lifepress/tags/2.2.2/includes/admin/class-admin-ajax.php#L110 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/4fa5b8a9-1683-4806-987d-527834f45d34?source=cve · Note
• https://plugins.trac.wordpress.org/browser/lifepress/tags/2.2.2/includes/admin/class-admin-ajax.php#L25 · Note
• https://plugins.trac.wordpress.org/browser/lifepress/tags/2.2.2/includes/class-metrics.php#L355 · Note
• https://twitter.com/KaitanSecurity/status/2054131988362121510 · Twitter Post