CVE-2026-14207
Received Received - Intake

Stored XSS in LifterLMS WordPress Plugin

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: WPScan

Description
The LifterLMS WordPress plugin before 10.0.10 does not strip event-handler attributes from a course pricing field before storing and rendering it, allowing users with a course-editing role to inject JavaScript that executes in the session of an administrator who views the course.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-30
Last Modified
2026-07-30
Generated
2026-08-19
AI Q&A
2026-07-30
EPSS Evaluated
2026-08-18
NVD
CVE-2026-14207
EUVD
EUVD-2026-50993

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
lifterlms lifterlms to 10.0.10 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored Cross-Site Scripting (XSS) vulnerability in the LifterLMS WordPress plugin before version 10.0.10. It allows users with a course-editing role to inject malicious JavaScript by entering HTML with event-handler attributes like onclick in the course pricing field. The injected script is stored without sanitization and executes when an administrator views the course.

Detection Guidance

Check if your LifterLMS plugin version is below 10.0.10. Inspect course pricing fields for event-handler attributes like onclick in the Featured Pricing Information section. Review course metadata for suspicious JavaScript snippets.

Impact Analysis

An attacker with a course-editing role could steal sensitive data like session cookies or admin credentials, perform unauthorized actions on behalf of the admin, or modify course content. Administrators viewing the compromised course would unknowingly execute the malicious script.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection. If exploited, it may result in data breaches, triggering legal penalties, loss of trust, and compliance violations.

Mitigation Strategies

Update the LifterLMS plugin to version 10.0.10 or later immediately. Remove any untrusted user access to course-editing roles. Audit existing courses for injected scripts in pricing fields and sanitize stored data.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14207. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart