CVE-2026-4333

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4333", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-03-17T14:08:14.694Z", "datePublished": "2026-04-08T03:36:07.559Z", "dateUpdated": "2026-04-08T16:37:04.041Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:37:04.041Z"}, "affected": [{"vendor": "thimpress", "product": "LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.3.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The LearnPress \u2013 WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'skin' attribute of the learn_press_courses shortcode in all versions up to and including 4.3.3. This is due to insufficient input sanitization and output escaping on the 'skin' shortcode attribute. The attribute value is used directly in an sprintf() call that generates HTML (class attribute and data-layout attribute) without any esc_attr() escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "LearnPress <= 4.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'skin' Shortcode Attribute", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/15fb0a26-e415-4ccb-b83d-d8f7b36bce66?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/learnpress/trunk/inc/Shortcodes/Courses/ListCoursesShortcode.php#L76"}, {"url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.2.8/inc/Shortcodes/Courses/ListCoursesShortcode.php#L76"}, {"url": "https://plugins.trac.wordpress.org/browser/learnpress/trunk/inc/Shortcodes/Courses/ListCoursesShortcode.php#L55"}, {"url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.2.8/inc/Shortcodes/Courses/ListCoursesShortcode.php#L55"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3494377%40learnpress&new=3494377%40learnpress&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Djaidja Moundjid"}], "timeline": [{"time": "2026-03-17T14:23:25.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-04-07T15:19:06.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-08T15:07:21.799123Z", "id": "CVE-2026-4333", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T15:07:32.175Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-4333", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-08T15:07:21.799123Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-08T15:07:25.714Z"}}], "cna": {"title": "LearnPress <= 4.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'skin' Shortcode Attribute", "credits": [{"lang": "en", "type": "finder", "value": "Djaidja Moundjid"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "thimpress", "product": "LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.3.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-03-17T14:23:25.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-04-07T15:19:06.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/15fb0a26-e415-4ccb-b83d-d8f7b36bce66?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/learnpress/trunk/inc/Shortcodes/Courses/ListCoursesShortcode.php#L76"}, {"url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.2.8/inc/Shortcodes/Courses/ListCoursesShortcode.php#L76"}, {"url": "https://plugins.trac.wordpress.org/browser/learnpress/trunk/inc/Shortcodes/Courses/ListCoursesShortcode.php#L55"}, {"url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.2.8/inc/Shortcodes/Courses/ListCoursesShortcode.php#L55"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3494377%40learnpress&new=3494377%40learnpress&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The LearnPress \u2013 WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'skin' attribute of the learn_press_courses shortcode in all versions up to and including 4.3.3. This is due to insufficient input sanitization and output escaping on the 'skin' shortcode attribute. The attribute value is used directly in an sprintf() call that generates HTML (class attribute and data-layout attribute) without any esc_attr() escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:37:04.041Z"}}}, "cveMetadata": {"cveId": "CVE-2026-4333", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:37:04.041Z", "dateReserved": "2026-03-17T14:08:14.694Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-04-08T03:36:07.559Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses", "vendor": "thimpress", "versions": [{"lessThanOrEqual": "4.3.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The LearnPress \u2013 WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'skin' attribute of the learn_press_courses shortcode in all versions up to and including 4.3.3. This is due to insufficient input sanitization and output escaping on the 'skin' shortcode attribute. The attribute value is used directly in an sprintf() call that generates HTML (class attribute and data-layout attribute) without any esc_attr() escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin LearnPress - WordPress LMS Plugin para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s del atributo 'skin' del shortcode learn_press_courses en todas las versiones hasta la 4.3.3 inclusive. Esto se debe a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes en el atributo 'skin' del shortcode. El valor del atributo se utiliza directamente en una llamada a sprintf() que genera HTML (atributo de clase y atributo data-layout) sin ning\u00fan escape esc_attr(). Esto hace posible que atacantes autenticados, con acceso de nivel Colaborador y superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2026-4333", "lastModified": "2026-07-24T20:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4333", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-08T15:07:21.799123Z", "version": "2.0.3"}}]}, "published": "2026-04-08T05:16:06.683", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.2.8/inc/Shortcodes/Courses/ListCoursesShortcode.php#L55"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/learnpress/tags/4.3.2.8/inc/Shortcodes/Courses/ListCoursesShortcode.php#L76"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/learnpress/trunk/inc/Shortcodes/Courses/ListCoursesShortcode.php#L55"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/learnpress/trunk/inc/Shortcodes/Courses/ListCoursesShortcode.php#L76"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3494377%40learnpress&new=3494377%40learnpress&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/15fb0a26-e415-4ccb-b83d-d8f7b36bce66?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.3.3]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "LearnPress \u2013 WordPress LMS Plugin for Create and Sell Online Courses", "source": "cna", "vendor": "thimpress"}, "product": "learnpress_\u2013_wordpress_lms_plugin_for_create_and_sell_online_courses", "vendor": "thimpress"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-08T05:50:34.483852+00:00", "value": {"mitigation_remediation": ["Update LearnPress to version 4.3.4 or later.", "If an immediate update is not possible, remove or sanitize the 'skin' attribute from all instances of the learn_press_courses shortcode.", "Review and restrict Contributor and higher roles to limit who can edit page content containing shortcodes."], "summary": {"action": "Patch Immediately", "impact": "Stored XSS via the 'skin' attribute of the learn_press_courses shortcode"}, "threat_synthesis": {"affected_systems": "All installations of the LearnPress WordPress LMS Plugin up to and including version 4.3.3 are affected. Users who can edit or create pages containing the learn_press_courses shortcode can insert the vulnerable attribute. Upgrading to any release newer than 4.3.3 removes the vulnerability.", "description_and_impact": "The LearnPress plugin contains a stored cross\u2011site scripting flaw that allows any authenticated user with Contributor or higher privileges to inject malicious JavaScript through the 'skin' attribute of the learn_press_courses shortcode. The value entered is incorporated directly into HTML attributes without sanitization, so the script executes in the browsers of every visitor to pages that contain the malicious shortcode, enabling session hijacking, defacement, or other client\u2011side attacks.", "risk_and_exploitability": "The CVSS base score of 6.4 indicates a medium\u2011to\u2011high risk. No exploit probability score is available, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. Because the attack requires authenticated access and involves a widely used WordPress shortcode, it could be exploited opportunistically by anyone with Contributor access or higher, affecting the integrity and confidentiality of users viewing the compromised content."}}}}, "created": "2026-04-08T19:33:29.153784+00:00", "updated": "2026-04-08T19:44:06.290901+00:00", "vendors": ["thimpress", "thimpress$PRODUCT$learnpress_\u2013_wordpress_lms_plugin_for_create_and_sell_online_courses", "wordpress", "wordpress$PRODUCT$wordpress"]}