CVE-2026-12732

Name of the Vulnerable Software and Affected Versions LearnPress versions prior to 4.4.1

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping in the FilterCourseTemplate::sections() function. An authenticated attacker with contributor-level access or higher can inject arbitrary web scripts through the class wrapper form attribute of the class wrapper form shortcode. The issue arises because the FilterCourseShortcode::render() handler fails to apply shortcode atts() filtering, allowing raw user attributes to be inserted into an HTML class attribute via sprintf() without proper esc attr() escaping. These scripts execute whenever a user visits the affected page.

Recommendations Update LearnPress to a version newer than 4.4.0. As a temporary mitigation, restrict users with contributor-level access from creating or editing pages containing shortcodes.