CVE-2026-109208

Name of the Vulnerable Software and Affected Versions LearnPress versions prior to 4.4.11

Description Insufficient input sanitization and output escaping allow for Stored Cross-Site Scripting. This occurs via the quantity parameter in the REST API and the order comments parameter during checkout. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses the affected page. If guest checkout is enabled, the attack is fully unauthenticated; otherwise, users with Subscriber-level privileges can exploit these vectors through their own checkout process.

Recommendations Update LearnPress to version 4.4.11 or later. As a temporary mitigation, restrict the use of the quantity and order comments parameters or disable guest checkout to limit the attack surface.