CVE-2026-86444: LearnPress < 4.4.7 - Reflected XSS via 'skin' Parameter

Q: Which sites are exposed to this issue?

Sites using LearnPress versions earlier than 4.4.7 are affected only when they run a classic, non-block theme. Sites using a block theme are not described as affected.

Q: Does exploitation require an account or other prior access?

No. An unauthenticated attacker can exploit the issue by persuading someone to open a crafted link.

Q: What is the practical impact if an administrator opens a malicious link?

The crafted link can execute arbitrary JavaScript in the administrator's browser. The issue is reflected XSS and occurs on a public page.

Published Sep 16, 2026

Updated

The LearnPress WordPress plugin before 4.4.7 does not escape a user supplied value before using it in an HTML attribute on a public page, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of anyone who opens a crafted link, including a logged in administrator. Only sites running a classic, non-block are affected.

Event History

Sep 16, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which sites are exposed to this issue?

Sites using LearnPress versions earlier than 4.4.7 are affected only when they run a classic, non-block theme. Sites using a block theme are not described as affected.

Does exploitation require an account or other prior access?

No. An unauthenticated attacker can exploit the issue by persuading someone to open a crafted link.

What is the practical impact if an administrator opens a malicious link?

The crafted link can execute arbitrary JavaScript in the administrator's browser. The issue is reflected XSS and occurs on a public page.