CVE-2026-14207 — LifterLMS < 10.0.10 - Instructor+ Stored XSS via Featured Pricing Information
The LifterLMS WordPress plugin before 10.0.10 does not strip event-handler attributes from a course pricing field before storing and rendering it, allowing users with a course-…
Published: 2026-07-30 · CVSS: 6.1 · CVSS 3.1
The LifterLMS WordPress plugin before 10.0.10 does not strip event-handler attributes from a course pricing field before storing and rendering it, allowing users with a course-editing role to inject JavaScript that executes in the session of an administrator who views the course.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7