CVE-2026-105397: Thimpress Learnpress

Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days.

LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role can submit unsanitized payloads through the update_question AJAX handler that execute in the session of every student taking the quiz.

Affected products

• Thimpress Learnpress: up to and including 4.4.9.1

Published 2026-10-05. Last modified 2026-10-07.