Unknown Lifterlms vulnerabilities

3 vulnerabilities

Known vulnerabilities in Unknown Lifterlms, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

6.1CVE-2024-13619lifterlmslifterlms+2
EPSS score
0.58%
The LifterLMS WordPress plugin before 8.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.6.4CVE-2026-14207unknownlifterlms+1
EPSS score
0.25%
The LifterLMS WordPress plugin before 10.0.10 does not strip event-handler attributes from a course pricing field before storing and rendering it, allowing users with a course-editing role to inject JavaScript that executes in the session of an administrator who views the course.4.3CVE-2026-14231unknownlifterlms+1
EPSS score
0.29%
The LifterLMS WordPress plugin before 10.0.10 does not perform a capability check in one of its select2 query AJAX handlers, only verifying that the user is logged in, allowing any authenticated user with subscriber-level access to read the titles of internal post types such as coupon codes by supplying the post type.