CVE-2026-105397 ThimPress CVE debrief

Who should care

Defenders responsible for WordPress installations with the LearnPress plugin, particularly those with Instructor roles, should assess exposure and verify LearnPress versions to prevent potential XSS attacks.

Why it matters

The LearnPress WordPress Plugin through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Defenders should prioritize verifying and updating LearnPress installations to prevent potential XSS attacks.

• Potential script injection by authenticated instructors via quiz question hint and explanation fields
• Execution of injected scripts in the session of every student taking the quiz
• Possible disruption of quiz functionality or student experience
• Need for verification of LearnPress version and Instructor role privileges

Technical summary

The LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role can submit unsanitized payloads through the update_question AJAX handler that execute in the session of every student taking the quiz. The vulnerability requires Instructor role privileges and can lead to potential script injection, execution of injected scripts, and disruption of quiz functionality.

Defensive priority

Defenders should prioritize verifying and updating LearnPress installations to prevent potential XSS attacks.

Recommended defensive actions

• Verify LearnPress version and update to a patched version if available
• Restrict Instructor role privileges to prevent unauthorized script injection
• Implement additional security measures to detect and prevent XSS attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is confirmed in LearnPress versions up to 4.4.9.1. Authenticated instructors can inject scripts via quiz question hint and explanation fields using the update_question AJAX handler. The attack requires Instructor role privileges, and defenders should verify LearnPress version and Instructor role privileges to prevent potential XSS attacks. Evidence is limited to public CVE Program records and LearnPress plugin documentation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.