CVE-2026-14207
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The LifterLMS WordPress plugin before version 10.0.10 does not strip event-handler attributes from a course pricing field before storing and rendering it. This allows users with a course-editing role to inject JavaScript that executes in the session of an administrator who views the course.
Risk Assessment
Attackers with course-editor privileges can hijack an administrator's session, potentially leading to full compromise of the WordPress site.
Recommendation
Update the LifterLMS plugin to version 10.0.10 or later, which properly sanitizes HTML attributes.
Other vulnerabilities in LifterLMS
See all- CVE-2026-104723High
The LifterLMS plugin for WordPress up to version 10.2.1 is vulnerable to PHP Object Injection via deserialization of untrusted input. Authenticated attackers with 'edit_course' capability (e.g., instructors) can inject a PHP object, which may lead to file deletion, data theft, or code execution if a POP chain is present in another plugin or theme.
- CVE-2026-14231Medium
The LifterLMS WordPress plugin before version 10.0.10 does not perform a capability check in one of its select2 query AJAX handlers, only verifying that the user is logged in. This allows any authenticated user with subscriber-level access to read the titles of internal post types such as coupon codes by supplying the post type.
Original NVD description (English source)
The LifterLMS WordPress plugin before 10.0.10 does not strip event-handler attributes from a course pricing field before storing and rendering it, allowing users with a course-editing role to inject JavaScript that executes in the session of an administrator who views the course.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS