Executive brief
LifterLMS is a popular WordPress plugin used to create and sell online courses. A security flaw allows users with course-editing permissions (such as Instructors) to embed malicious scripts into course pricing fields. If an administrator views the affected course, these scripts could execute in their browser, potentially allowing the attacker to perform unauthorized actions or access sensitive administrative data.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in LifterLMS versions prior to 10.0.10. The root cause is insufficient sanitization of the 'Featured Pricing Information' field, which fails to strip HTML event-handler attributes (e.g., onclick) before storing them in the _llms_featured_pricing meta. An attacker with 'Instructor' or higher privileges can inject a payload that executes when an administrator views the course in the WordPress editor or when a user interacts with the field on the public catalog page. This can lead to session hijacking or unauthorized administrative actions. The issue is resolved in version 10.0.10.
Affected products
- LifterLMS LifterLMS < 10.0.10
Timeline
- 2026-07-10: disclosed: Publicly published by researcher
- 2026-07-10: patched: Fixed in version 10.0.10
- 2026-07-30: advisory: NVD publication date