CVE-2026-118054: LearnPress <= 4.2.2 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'review_title' Parameter

Q: Which users can submit an exploit payload?

An attacker needs an authenticated WordPress account with at least Subscriber-level access. The affected input is the review_title value submitted in course reviews.

Q: Does a malicious review execute immediately after submission?

No. The stored payload executes when someone accesses the injected page only after an administrator approves the review. Manual moderation may be bypassed on sites configured to auto-approve previously approved commenters through comment_previously_approved.

Q: Are default plugin versions affected?

All LearnPress – Course Review versions through 4.2.2 are affected. The provided information does not state whether any particular WordPress or plugin configuration is safe by default beyond the review-approval condition.

Q: How can administrators check for possible exploitation?

Review submitted and approved course reviews for suspicious content in their titles, especially reviews submitted by low-privileged accounts. Investigate whether review auto-approval is enabled through comment_previously_approved, since that can allow payloads to be approved without manual moderation.

Published Nov 7, 2026

Updated

The LearnPress – Course Review plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'reviewtitle (inside data.args.reviewtitle)' parameter in all versions up to, and including, 4.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload only executes after an administrator approves the submitted review, though sites with commentpreviouslyapproved auto-approval configured may bypass manual moderation.

Event History

Nov 7, 2026

CVE Published

via MITRE·02:29 AM

Data Sourced

via MITRE·02:29 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which users can submit an exploit payload?

An attacker needs an authenticated WordPress account with at least Subscriber-level access. The affected input is the review_title value submitted in course reviews.

Does a malicious review execute immediately after submission?

No. The stored payload executes when someone accesses the injected page only after an administrator approves the review. Manual moderation may be bypassed on sites configured to auto-approve previously approved commenters through comment_previously_approved.

Are default plugin versions affected?

All LearnPress – Course Review versions through 4.2.2 are affected. The provided information does not state whether any particular WordPress or plugin configuration is safe by default beyond the review-approval condition.

How can administrators check for possible exploitation?

Review submitted and approved course reviews for suspicious content in their titles, especially reviews submitted by low-privileged accounts. Investigate whether review auto-approval is enabled through comment_previously_approved, since that can allow payloads to be approved without manual moderation.

CVE-2026-118054: LearnPress <= 4.2.2 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'review_title' Parameter

Event History

Frequently Asked Questions

Which users can submit an exploit payload?

Does a malicious review execute immediately after submission?

Are default plugin versions affected?

How can administrators check for possible exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which users can submit an exploit payload?

Does a malicious review execute immediately after submission?

Are default plugin versions affected?

How can administrators check for possible exploitation?