What is the CVSS score of CVE-2026-14207?

CVE-2026-14207 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2026-14207?

Yes, a public proof-of-concept exploit is available for CVE-2026-14207. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2026-14207?

Yes, a patch is available for CVE-2026-14207. Update the affected software to the latest version immediately.

LifterLMS CVE-2026-14207

EUVD-2026-50993 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-30 WPScan

GHSA-rw87-6jm9-frww

WordPress XSS Lifterlms Unknown

6.1

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

PR:L required because exploitation demands an authenticated course-editor account; UI:R because admin must view the course; S:C reflects admin session as the ultimate target.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 14:57 vuln.today

CVSS changed

Jul 30, 2026 - 14:37 NVD

6.1 (None) 6.1 (MEDIUM)

Patch available

Jul 30, 2026 - 07:03 EUVD

CVE Published

Jul 30, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 06:00 cve.org

MEDIUM 6.1

DescriptionCVE.org

The LifterLMS WordPress plugin before 10.0.10 does not strip event-handler attributes from a course pricing field before storing and rendering it, allowing users with a course-editing role to inject JavaScript that executes in the session of an administrator who views the course.

AnalysisAI

Stored cross-site scripting in LifterLMS WordPress plugin versions before 10.0.10 allows authenticated course editors to inject event-handler JavaScript into course pricing fields, which then executes in administrator browser sessions when the course is viewed. A publicly available proof-of-concept from WPScan confirms exploitability. EPSS at 0.17% (7th percentile) indicates low opportunistic exploitation probability, consistent with the authenticated-insider requirement and dependence on manual admin interaction.

Technical ContextAI

This is a CWE-79 (Stored Cross-Site Scripting) vulnerability in the LifterLMS WordPress plugin (CPE: cpe:2.3:a:unknown:lifterlms:*:*:*:*:*:*:*:*). The plugin fails to sanitize or strip HTML event-handler attributes (e.g., onclick, onerror, onmouseover) from course pricing input fields before persisting them to the WordPress database and rendering them in the admin interface. Because the payload is stored rather than reflected, it persists across sessions and fires each time a qualifying administrator views the affected course. The CVSS scope change (S:C) reflects that the injected script executes in the administrator's browser context rather than the course editor's, giving the attacker leverage over a higher-privileged session than their own.

RemediationAI

Update LifterLMS to version 10.0.10 or later, which strips event-handler attributes from course pricing fields before storage and rendering (patch confirmed available from vendor). As an interim compensating control, restrict the course-editor role assignment to fully trusted accounts only and audit existing course pricing content for suspicious HTML attributes such as inline event handlers. Site operators may deploy a WAF rule to block event-handler attribute patterns (e.g., on[a-z]+=) in POST requests to the affected pricing field endpoint, though this may interfere with legitimate rich-text course content and requires testing before deployment in production. Reference the WPScan advisory at https://wpscan.com/vulnerability/19085d43-63b2-4fee-b06b-c21ab96236fb/ for disclosure details.