CVE-2026-92538: LearnPress <= 4.4.7 - Reflected DOM-Based Cross-Site Scripting via 'orderby' Parameter
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'orderby' parameter in all versions up to, and including, 4.4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker does not need to authenticate. Exploitation requires persuading a user to perform an action such as clicking an attacker-controlled link containing a malicious orderby parameter.
Which installations are affected?
LearnPress versions up to and including 4.4.7 are affected. The available information does not identify any configuration prerequisite, so installations running an affected version should be treated as exposed.
What could happen if exploitation succeeds?
Arbitrary web scripts can execute in the context of the page viewed by the targeted user. The supplied severity vector indicates potential low-impact confidentiality and integrity effects, with no availability impact.
How can I determine whether I am affected?
Check the installed LearnPress version. Versions 4.4.7 and earlier are affected according to the available information.