PT-2026-61528 · WordPress · Learnpress

CVE-2026-12970 · Published 2026-07-20 · Updated 2026-07-20

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions LearnPress WordPress plugin versions prior to 4.4.1

Description Reflected Cross-Site Scripting occurs because the plugin fails to escape a search parameter before reflecting it into an HTML attribute. This allows an attacker to execute scripts in the browser of a logged-in instructor or administrator who is tricked into opening a crafted link.

Recommendations Update the plugin to version 4.4.1 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-12970

Affected Products

Learnpress

References · 3

• 🔥 https://wpscan.com/vulnerability/d0a2780f-ab13-4bb8-935d-2aeba1de12d2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-12970 · Security Note
• https://twitter.com/VulmonFeeds/status/2079135547428045062 · Twitter Post