# CVE-2026-14207: LifterLMS stored XSS in Featured Pricing Information field

Source: https://junglewise.ai/threats/cve-2026-14207-lifterlms-stored-xss-in-featured-pricing-information-field  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-30. Updated: 2026-07-30  
License: CC BY 4.0 with a link back

CVE-2026-14207 · Severity: info · CVSS 6.8 · Published 2026-07-30

LifterLMS is a popular WordPress plugin used to create and sell online courses. A security flaw allows users with course-editing permissions (such as Instructors) to embed malicious scripts into course pricing fields. If an administrator views the affected course, these scripts could execute in their browser, potentially allowing the attacker to perform unauthorized actions or access sensitive administrative data.

Technologies: [LifterLMS](https://junglewise.ai/threats/technologies/lifterlms). Vendors: [LifterLMS](https://junglewise.ai/threats/vendors/lifterlms).

## Quick answers

**Is CVE-2026-14207 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14207 being exploited in the wild.

**How severe is CVE-2026-14207?** Informational severity, with a CVSS score of 6.8, published 30 July 2026.

**Which products and versions are affected?** LifterLMS < 10.0.10.

**Is there a fix for CVE-2026-14207?** A patch was published on 2026-07-10: Fixed in version 10.0.10 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-14207 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-14207?** Check whether you run LifterLMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in LifterLMS versions prior to 10.0.10. The root cause is insufficient sanitization of the 'Featured Pricing Information' field, which fails to strip HTML event-handler attributes (e.g., onclick) before storing them in the _llms_featured_pricing meta. An attacker with 'Instructor' or higher privileges can inject a payload that executes when an administrator views the course in the WordPress editor or when a user interacts with the field on the public catalog page. This can lead to session hijacking or unauthorized administrative actions. The issue is resolved in version 10.0.10.

## Affected products

- LifterLMS LifterLMS < 10.0.10

## Timeline

- 2026-07-10: disclosed: Publicly published by researcher
- 2026-07-10: patched: Fixed in version 10.0.10
- 2026-07-30: advisory: NVD publication date

## References

- [https://wpscan.com/vulnerability/19085d43-63b2-4fee-b06b-c21ab96236fb/](https://wpscan.com/vulnerability/19085d43-63b2-4fee-b06b-c21ab96236fb/)

## Related threats

- [LifterLMS stored cross-site scripting in quiz answer parameter](https://junglewise.ai/threats/cve-2026-119098-the-lifterlms-wp-lms-for-elearning-online-courses-quizzes-plugin)
- [LifterLMS WordPress plugin information disclosure in select2_query_posts](https://junglewise.ai/threats/cve-2026-14231-lifterlms-wordpress-plugin-information-disclosure-in-select2)