CVE-2026-92538

Name of the Vulnerable Software and Affected Versions LearnPress – WordPress LMS Plugin for Create and Sell Online Courses versions prior to 4.4.8

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected DOM-Based Cross-Site Scripting. This occurs when an attacker tricks a user into clicking a link containing a malicious script injected via the orderby parameter, which then executes in the user's browser.

Recommendations Update the plugin to version 4.4.8 or later. As a temporary mitigation, restrict or sanitize the use of the orderby parameter.