CVE-2026-14207 in LifterLMS Plugin
Summary
by MITRE • 07/30/2026
The LifterLMS WordPress plugin before 10.0.10 does not strip event-handler attributes from a course pricing field before storing and rendering it, allowing users with a course-editing role to inject JavaScript that executes in the session of an administrator who views the course.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/30/2026
The vulnerability in LifterLMS WordPress plugin versions prior to 10.0.10 represents a critical cross-site scripting flaw that stems from inadequate input sanitization within the course pricing field functionality. This issue occurs when the plugin fails to properly strip event-handler attributes from user-supplied data before storing and rendering it within the administrative interface. The flaw specifically affects users with course-editing privileges who can leverage this vulnerability to inject malicious javascript code into the pricing field, which then executes in the context of an administrator session when they view or edit the affected course.
The technical implementation of this vulnerability demonstrates a classic failure in output encoding and input validation practices that aligns with CWE-79 - Cross-site Scripting. The plugin's insufficient sanitization process allows attackers to bypass security controls by injecting javascript code through what appears to be a legitimate data entry field. When administrators access the course editing interface, their browsers execute the injected javascript within the context of their privileged session, effectively providing attackers with administrative capabilities. This vulnerability operates under the principle that user-supplied content should never be trusted and must be properly sanitized before being rendered in any context.
The operational impact of this vulnerability extends beyond simple data theft or defacement, as it enables full administrative compromise of WordPress sites using vulnerable LifterLMS installations. Attackers can execute javascript code with elevated privileges, potentially leading to complete system takeover through various attack vectors including credential theft, data exfiltration, malware deployment, or privilege escalation within the WordPress environment. The vulnerability is particularly dangerous because it requires minimal privileges to exploit and can be leveraged by attackers who gain access to course editing capabilities through legitimate means such as user account compromise or social engineering attacks.
Mitigation strategies for this vulnerability must address both immediate remediation and long-term security hardening measures. The primary solution involves upgrading to LifterLMS version 10.0.10 or later, which implements proper input sanitization and event-handler attribute removal. Organizations should also implement additional security controls such as role-based access restrictions, regular security audits of plugin installations, and monitoring for suspicious administrative activities. The vulnerability's exploitation aligns with ATT&CK technique T1059.007 - Command and Scripting Interpreter: JavaScript, where attackers leverage javascript execution capabilities within web applications to maintain persistence and escalate privileges. Security teams should also consider implementing content security policies and regular vulnerability scanning of their WordPress environments to prevent similar issues in other plugins or themes that may suffer from inadequate input validation.