CVE-2026-86444

LearnPress < 4.4.7 - Reflected XSS via 'skin' Parameter

The LearnPress WordPress plugin before 4.4.7 does not escape a user supplied value before using it in an HTML attribute on a public page, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of anyone who opens a crafted link, including a logged in administrator. Only sites running a classic, non-block are affected.

Affected

LearnPress

CVSS v3.1 CNA

7.1 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

EPSS

0.28% chance of exploitation in the next 30 days, 19th percentile

Published

2026-09-16

Updated

2026-09-17

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/c11f39bd-7db8-495f-9118-48b63ee0858f/

References

• CVE Record
• NVD entry