CVE-2026-105397: LearnPress WordPress Plugin through 4.4.9.1 Stored XSS via Quiz Question Hint and Explanation
LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role can submit unsanitized payloads through the updatequestion AJAX handler that execute in the session of every student taking the quiz.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue, and who is exposed to the injected script?
An authenticated user with the LearnPress Instructor role can inject script content through quiz question hint or explanation fields. The payload executes in the browser session of every student who takes the affected quiz.
Does exploitation require a student to take an action?
Yes. A student must take the quiz containing the malicious question for the stored script to execute in that student's session.
Which component handles the vulnerable input?
The affected input is submitted through the update_question AJAX handler, using quiz question hint and explanation fields.