CVE-2026-12230: LearnPress WordPress LMS Plugin XSS Vulnerability

CVE-2026-12230 Overview

CVE-2026-12230 is a Stored Cross-Site Scripting (XSS) vulnerability in the LearnPress – WordPress LMS Plugin for Create and Sell Online Courses. The flaw affects all plugin versions up to and including 4.3.9.1. It stems from insufficient input sanitization and output escaping on the layout_custom_css parameter within the plugin's Elementor integration. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript that executes when other users view the affected pages. The issue is tracked under CWE-79 and is documented in the Wordfence Vulnerability Report.

Critical Impact
Authenticated contributors can persist malicious JavaScript into rendered pages, enabling session theft, administrator account takeover, and drive-by redirection of site visitors.

Affected Products

LearnPress – WordPress LMS Plugin versions through 4.3.9.1
LearnPress Elementor widget integration (ListInstructorsElementor.php)
WordPress sites running LearnPress with contributor-or-higher user provisioning

Discovery Timeline

2026-09-08 - CVE-2026-12230 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-12230

Vulnerability Analysis

The vulnerability resides in LearnPress's Elementor widget code, specifically in inc/ExternalPlugin/Elementor/Widgets/Instructor/ListInstructorsElementor.php. The widget accepts a layout_custom_css parameter intended to let editors apply custom CSS to instructor list layouts. The plugin fails to sanitize this input on save and does not escape it on output. Attackers can therefore break out of the intended CSS context and inject arbitrary HTML or JavaScript payloads that persist in the database.

Because the payload is stored, every subsequent visitor rendering the affected widget executes the injected script under the site's origin. This enables cookie theft, forced actions against authenticated administrators, and defacement. The scope-changed CVSS vector reflects that a low-privileged contributor can affect other users, including higher-privileged administrators viewing the compromised content.

Root Cause

The root cause is a missing sanitization step between the request handler that accepts widget settings and the render path that emits them into the page. See the pre-patch source at ListInstructorsElementor.php lines 45 and 82 (tag 4.3.4) and the updated logic in tag 4.4.0.

Attack Vector

An authenticated attacker with contributor privileges edits or creates an Elementor page that includes the LearnPress instructor list widget. The attacker supplies a crafted layout_custom_css value containing a </style> breakout followed by a <script> payload. When any user, including administrators, loads the resulting page, the injected script runs in their browser session against the WordPress origin.

No verified public exploit code is available. The vulnerability mechanism is described in prose per the referenced advisory rather than reproduced here.

Detection Methods for CVE-2026-12230

Indicators of Compromise

Elementor widget instances containing <script>, javascript:, or </style> sequences inside the layout_custom_css setting stored in wp_postmeta.
Unexpected outbound requests from administrator browsers to attacker-controlled domains after viewing LearnPress instructor pages.
Creation of new administrator accounts or modification of user roles shortly after a contributor edits a LearnPress-powered page.

Detection Strategies

Query the WordPress database for _elementor_data post meta entries that include the string layout_custom_css alongside HTML tag characters.
Review contributor and author account activity for edits to pages that render the LearnPress instructor list widget.
Correlate WordPress audit logs with web server logs to identify page views that triggered anomalous script execution.

Monitoring Recommendations

Enable a WordPress audit logging plugin to record post edits, user role changes, and plugin configuration updates.
Deploy a web application firewall rule that inspects Elementor save requests for script payloads in CSS-labeled fields.
Alert on newly created administrator accounts and on wp-admin sessions originating from unusual geographies.

How to Mitigate CVE-2026-12230

Immediate Actions Required

Update the LearnPress plugin to a version later than 4.3.9.1 as soon as the vendor publishes a fixed release.
Audit all contributor, author, and editor accounts and remove any that are unused or unverified.
Review existing LearnPress-powered pages for injected content in the layout_custom_css field and revert affected posts.

Patch Information

The vulnerable code path is documented in the LearnPress 4.3.4 source tree, with updates visible in the 4.4.0 branch. Site administrators should track the Wordfence advisory for the confirmed fixed version and upgrade immediately upon release.

Workarounds

Restrict contributor-level and above accounts to trusted users until the plugin is patched.
Disable the LearnPress Elementor instructor list widget or the LearnPress plugin entirely if contributor accounts cannot be constrained.
Deploy a WAF ruleset that blocks HTML tag characters within Elementor widget setting fields tagged as CSS.

bash

# Configuration example: temporarily restrict contributor publishing via wp-cli
wp cap remove contributor edit_posts
wp cap remove contributor publish_posts
# Re-grant after upgrading LearnPress to a patched release