CVE-2026-82024— LearnPress WordPress Plugin < 4.4.6 Stored XSS via Quiz Question Answer Titles
Quick assessment
Affected
ThimPress LearnPress
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 LearnPress WordPress 插件 4.4.6 之前的版本中，存在一个存储型跨站脚本（XSS）漏洞，允许具有“讲师”（Instructor）角色的已认证攻击者通过向测验题目的答案标题字段提交未净化的输入，从而注入持久化的恶意代码。攻击者可以通过答案标题参数存储任意 JavaScript 代码，该代码经由未转义的 HTML 输出点（sink）进行渲染，并将在浏览受影响测验题目的用户（包括学生、其他讲师和管理员）的浏览器中执行。
Possible ATT&CK Techniques 1 AI
T1059 · Command and Scripting InterpreterAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| ThimPress | LearnPress | < 4.4.6 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-82024
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
LearnPress WordPress Plugin < 4.4.6 Stored XSS via Quiz Question Answer Titles
Source: CVE Program / CVE List V5
Vulnerability Description
LearnPress WordPress Plugin before 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers with the Instructor role to inject persistent malicious payloads by submitting unsanitized input into quiz question answer title fields. Attackers can store arbitrary JavaScript through the answer title parameter, which is rendered through an unescaped HTML sink to execute in the browsers of any user who views the affected quiz question, including students, other instructors, and administrators.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| ThimPress | LearnPress | 0 ~ 4.4.6 | - |
|
II. Public POCs for CVE-2026-82024
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-82024
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-82024 (1)
IV. Related Vulnerabilities
Same product: LearnPress
-
CVE-2026-82023
LearnPress WordPress Plugin < 4.4.6 Broken Object-Level Auth -
CVE-2026-78125
LearnPress – Sepay Payment < 4.0.3 - Unauthenticated Order S -
CVE-2026-12976
LearnPress < 4.4.4 - Subscriber+ Sensitive Information Expos -
CVE-2026-12971
LearnPress < 4.4.4 - Instructor+ Server-Side Request Forgery -
CVE-2026-12970
LearnPress < 4.4.1 - Reflected XSS via c_search
Same vendor: ThimPress
-
CVE-2026-82023
LearnPress WordPress Plugin < 4.4.6 Broken Object-Level Auth -
CVE-2026-77823
LearnPress <= 4.4.4 - Authenticated (Administrator+) SQL Inj -
CVE-2026-75982
LearnPress <= 4.4.4 - Missing Authorization to Authenticated -
CVE-2026-66458
WordPress RealPress plugin <= 1.1.2 - SQL Injection vulnerab -
CVE-2026-15464
WP Hotel Booking <= 2.3.2 - Authenticated (Contributor+) Sto
Same weakness: CWE-79
-
CVE-2026-85406
Eleveo Quality Management Conversation Review cross site scr -
CVE-2026-85405
Eleveo Call Recording Software roleAddAction.do cross site s -
CVE-2026-85382
light0011 cms Chapter Content Output oneChapter.tpl htmlspec -
CVE-2026-85453
MOOS core-moos through 10.4.0 MOOSDB HTTP Pages Stored Cross -
CVE-2026-85061
MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via L
V. Comments for CVE-2026-82024
No comments yet