CVE-2026-48865: WordPress LearnPress plugin <= 4.3.6 - Reflected Cross Site Scripting (XSS) vulnerability

Synopsis

Reflected cross-site scripting (XSS) in the ThimPress LearnPress WordPress plugin (versions up to and including 4.3.6) allows a remote, unauthenticated attacker to inject malicious JavaScript into a victim's browser by tricking them into clicking a crafted link. The vulnerability is reachable over the network and requires no authentication, but does require the victim to interact with a malicious URL. Successful exploitation lets the attacker read session cookies, inject content into the page, or perform actions in the application on the victim's behalf. No fix version has been published; HarborGuard is tracking the advisory and will make a patched-image rebuild available as soon as an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the WordPress site over the network to deliver the crafted URL to a victim.

• AuthenticationNot required

  No account or credentials are needed; the attacker sends a malicious link that any unauthenticated user can trigger.

• Victim interactionRequired

  A victim must click the attacker-supplied link or otherwise load the crafted URL in their browser for the payload to execute.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental setup beyond delivering the malicious URL.

Blast Radius

• The attacker's injected script runs in the victim's browser session and can read session cookies, potentially hijacking the victim's authenticated WordPress account.
• Page content can be modified in the victim's browser, enabling phishing overlays or redirection to attacker-controlled sites.
• The script can issue requests on behalf of the victim inside the application, such as enrolling in courses, modifying profile data, or performing any action the victim is authorized to take.
• Confidentiality, integrity, and availability are each impacted at a limited scope within the victim's browser context, scoped to the affected WordPress application.