CVE-2026-12970

LearnPress < 4.4.1 - Reflected XSS via c_search

High · published July 20, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
15.6
In the wild
Unconfirmed
What it is

The LearnPress WordPress plugin before 4.4.1 does not escape a search parameter before reflecting it into an HTML attribute, leading to Reflected Cross-Site Scripting that executes in the browser of a logged-in instructor or administrator who is tricked into opening a crafted link.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00251 · 15.6th percentile
Published
2026-07-20T06:00Z
EPSS history
Timeline
  • 20 JUL 06:00Z
    LearnPress < 4.4.1 - Reflected XSS via c_search
    cvelistv5