CVE-2026-24361: LearnPress Course Review XSS Vulnerability

CVE-2026-24361 Overview

CVE-2026-24361 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the LearnPress Course Review plugin for WordPress, developed by ThimPress. The vulnerability stems from improper neutralization of input during web page generation, allowing authenticated attackers to inject malicious scripts that persist in the application and execute when other users view affected pages.

Critical Impact

Authenticated attackers with low privileges can inject persistent malicious scripts into course reviews, potentially compromising administrator sessions, stealing credentials, or distributing malware to site visitors.

Affected Products

• LearnPress – Course Review plugin versions up to and including 4.1.9
• WordPress installations using the vulnerable plugin versions
• All WordPress sites with LearnPress Course Review enabled without input sanitization patches

Discovery Timeline

• 2026-01-22 - CVE-2026-24361 published to NVD
• 2026-01-22 - Last updated in NVD database

Technical Details for CVE-2026-24361

Vulnerability Analysis

This vulnerability exists due to insufficient input validation and output encoding in the LearnPress Course Review plugin. When users submit course reviews, the application fails to properly sanitize user-supplied input before storing it in the database and subsequently rendering it on web pages. This allows attackers to embed malicious JavaScript code within review content that executes in the browsers of other users who view the affected course pages.

The Stored XSS classification indicates that the malicious payload persists in the application's database, making it particularly dangerous as it can affect multiple victims over time without requiring the attacker to actively distribute malicious links. The vulnerability requires authentication with low privileges (such as a student account) but can impact users with higher privileges including administrators.

Root Cause

The root cause of this vulnerability is the failure to implement proper input sanitization and output encoding in the course review submission and display functionality. Specifically, the plugin does not adequately neutralize HTML and JavaScript constructs before storing review content or when rendering reviews to other users. This violates the security principle of treating all user input as untrusted and encoding output based on context.

Attack Vector

The attack vector is network-based and requires the attacker to have a valid low-privilege account on the WordPress site. The attacker submits a course review containing malicious JavaScript code. When other users, including administrators, view the course page containing the malicious review, the injected script executes in their browser context.

A successful exploitation scenario involves an attacker creating a course review containing JavaScript that steals session cookies or performs actions on behalf of the victim. The injected script could redirect administrators to phishing pages, create new administrative accounts, or modify site content. The changed scope indicated in the vulnerability assessment means the attack can affect resources beyond the vulnerable component itself.

The vulnerability can be exploited by embedding script tags or event handlers within review content fields. For detailed technical information, refer to the Patchstack Vulnerability Report.

Detection Methods for CVE-2026-24361

Indicators of Compromise

• Unusual JavaScript code patterns in course review content stored in the WordPress database
• Review entries containing <script> tags, event handlers (e.g., onerror, onload, onclick), or encoded script payloads
• Unexpected outbound connections from client browsers when viewing course pages
• Reports of browser warnings or unusual behavior when accessing course review pages

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect XSS patterns in POST requests to review submission endpoints
• Monitor database entries in LearnPress review tables for suspicious HTML/JavaScript content
• Deploy Content Security Policy (CSP) headers to detect and report inline script execution attempts
• Review server access logs for unusual patterns in course review submission requests

Monitoring Recommendations

• Enable WordPress security plugin logging to track review submissions and content changes
• Configure browser-side CSP violation reporting to identify XSS execution attempts
• Set up alerts for new user registrations followed immediately by review submissions
• Monitor for administrative actions that were not initiated through expected workflows

How to Mitigate CVE-2026-24361

Immediate Actions Required

• Update LearnPress Course Review plugin to the latest patched version immediately
• Review existing course reviews in the database for malicious content and remove any suspicious entries
• Implement a Web Application Firewall with XSS filtering rules
• Consider temporarily disabling the course review functionality until the patch is applied
• Force logout all users and invalidate existing sessions if compromise is suspected

Patch Information

ThimPress should release a patched version of the LearnPress Course Review plugin that addresses this vulnerability. Site administrators should monitor the WordPress plugin repository and the Patchstack advisory for update availability. Apply the security update as soon as it becomes available through the WordPress admin dashboard or via manual download.

Workarounds

• Disable the LearnPress Course Review plugin until a patch is available if course reviews are not critical to operations
• Implement server-side input validation to strip or encode HTML/JavaScript from review submissions
• Deploy Content Security Policy headers to prevent inline script execution
• Restrict course review submission to trusted user roles only
• Use a WordPress security plugin with XSS filtering capabilities as an additional layer of defense

# WordPress configuration to add CSP headers (add to .htaccess or server config)
# This helps mitigate XSS impact by restricting script sources
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline';"

# Alternatively, disable reviews via wp-config.php until patched
# Add the following to temporarily disable the plugin functionality
# define('LEARNPRESS_COURSE_REVIEW_DISABLE', true);