CVE-2026-109208: LearnPress <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' Parameters
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'quantity (REST) / ordercomments (checkout)' parameter in all versions up to, and including, 4.4.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. With guest checkout enabled the attack is fully unauthenticated; with guest checkout disabled, any Subscriber-level user can exploit both vectors through their own checkout.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue in a typical deployment?
If guest checkout is enabled, an unauthenticated remote attacker can exploit it. If guest checkout is disabled, a user with the Subscriber role can exploit both affected checkout vectors through their own checkout.
What conditions are required for the injected script to run?
The attacker must submit malicious content through the quantity REST parameter or the order_comments checkout parameter. The stored script executes when a user later accesses a page containing the injected content.
How can I determine whether my site is affected?
Sites using LearnPress versions up to and including 4.4.10 are affected. Review whether guest checkout is enabled and inspect checkout orders and related pages for unexpected script content in quantity or order comment data.