CVE-2026-82024

Name of the Vulnerable Software and Affected Versions LearnPress WordPress Plugin versions prior to 4.4.6

Description Authenticated attackers with the Instructor role can perform a stored cross-site scripting attack by submitting unsanitized input into quiz question answer title fields. The issue occurs because the answer title parameter is rendered through an unescaped HTML sink, allowing arbitrary JavaScript to be stored and executed in the browsers of users who view the affected quiz question, including students, other instructors, and administrators.

Recommendations Update LearnPress WordPress Plugin to version 4.4.6 or later.