VulnSocial

CVE-2026-4333Disclosure

LOWCVSS 6.4 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'skin' attribute of the learn_press_courses shortcode in all versions up to and including 4.3.3. This is due to insufficient input sanitization and output escaping on the 'skin' shortcode attribute. The attribute value is used directly in an sprintf() call that generates HTML (class attribute and data-layout attribute) without any esc_attr() escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 1 mentions (2026-04-08); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-04-08: 1Mentions · 2026-04-13: 1Technical Details · 2026-04-08: 1Technical Details · 2026-04-13: 104-0804-13
Signal classification1 categories
Disclosure
2100.0%
Referenced assets3 URLs
Full discourse2 posts
  • CVE@CVEnew
    Disclosure

    CVE-2026-4333 The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'skin' attribute of the learn_press_courses shortcode in… https://www.cve.org/CVERecord?id=CVE-2026-4333

    Post summary

    The passage announces CVE-2026-4333 as a stored XSS flaw in the LearnPress WordPress LMS plugin triggered by the 'skin' attribute in the learn_press_courses shortcode, with no PoC, exploit, or patch details disclosed.

    00000168
    57.1K followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-4333 Stored Cross-Site Scripting in LearnPress WordPress LMS Plugin 4.3... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-4333 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1

    Post summary

    The tweet announces a stored XSS vulnerability (CVE-2026-4333) affecting LearnPress WordPress LMS Plugin 4.3.

    0000059
    4.0K followersView on X

Explore more

Back to dashboard