Lifterlms
Monthly
Authenticated information disclosure in the LifterLMS WordPress plugin before 10.0.10 exposes internal post type titles - including coupon codes - to any subscriber-level user. The root cause is a missing capability check in a select2 query AJAX handler that only verifies login status, not whether the user holds an appropriate WordPress capability. A publicly available proof-of-concept exists (via WPScan), though EPSS sits at just 0.16% (5th percentile), indicating low broad exploitation likelihood; no active exploitation is confirmed by CISA KEV.
Stored cross-site scripting in LifterLMS WordPress plugin versions before 10.0.10 allows authenticated course editors to inject event-handler JavaScript into course pricing fields, which then executes in administrator browser sessions when the course is viewed. A publicly available proof-of-concept from WPScan confirms exploitability. EPSS at 0.17% (7th percentile) indicates low opportunistic exploitation probability, consistent with the authenticated-insider requirement and dependence on manual admin interaction.
SQL injection in the LifterLMS WordPress plugin (versions up to and including 8.0.6) lets remote attackers inject crafted SQL into a vulnerable query, exposing sensitive database contents such as user records, course data, and WordPress secrets. Patchstack assigns a critical 9.3 (CVSS 3.1) with an unauthenticated network vector, though there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.06%, 17th percentile). The flaw is a classic CWE-89 improper neutralization of special elements in an SQL command.
The LifterLMS WordPress plugin before 8.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The LifterLMS - WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Unauthenticated Post Trashing due to a missing capability check on the delete_access_plan. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The LifterLMS - WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to arbitrary post deletion due to a missing capability check on the 'llms_delete_cert' action in all. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The LifterLMS - WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to blind SQL Injection via the 'order' parameter in all versions up to, and including, 7.7.5 due to. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
The LifterLMS - WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to SQL Injection via the orderBy attribute of the lifterlms_favorites shortcode in all versions up to, and. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Cross-Site Request Forgery (CSRF) vulnerability in LifterLMS.5.0. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The LifterLMS - WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'process_review' function in all. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The LifterLMS - WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 7.4.2 via the maybe_serve_export function. Rated low severity (CVSS 3.3), this vulnerability is remotely exploitable. No vendor patch available.
The LifterLMS PayPal WordPress plugin before 1.4.0 does not sanitise and escape some parameters from the payment confirmation page before outputting them back in the page, leading to a Reflected. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The LMS by LifterLMS - Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4.21.2 was affected by an IDOR issue, allowing students to see other student answers. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The 'State' field of the Edit profile page of the LMS by LifterLMS - Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4.21.1 is not properly sanitised when. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
LifterLMS Wordpress plugin version below 3.37.15 is vulnerable to arbitrary file write leading to remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in the LifterLMS plugin through 3.34.5 for WordPress. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Authenticated information disclosure in the LifterLMS WordPress plugin before 10.0.10 exposes internal post type titles - including coupon codes - to any subscriber-level user. The root cause is a missing capability check in a select2 query AJAX handler that only verifies login status, not whether the user holds an appropriate WordPress capability. A publicly available proof-of-concept exists (via WPScan), though EPSS sits at just 0.16% (5th percentile), indicating low broad exploitation likelihood; no active exploitation is confirmed by CISA KEV.
Stored cross-site scripting in LifterLMS WordPress plugin versions before 10.0.10 allows authenticated course editors to inject event-handler JavaScript into course pricing fields, which then executes in administrator browser sessions when the course is viewed. A publicly available proof-of-concept from WPScan confirms exploitability. EPSS at 0.17% (7th percentile) indicates low opportunistic exploitation probability, consistent with the authenticated-insider requirement and dependence on manual admin interaction.
SQL injection in the LifterLMS WordPress plugin (versions up to and including 8.0.6) lets remote attackers inject crafted SQL into a vulnerable query, exposing sensitive database contents such as user records, course data, and WordPress secrets. Patchstack assigns a critical 9.3 (CVSS 3.1) with an unauthenticated network vector, though there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.06%, 17th percentile). The flaw is a classic CWE-89 improper neutralization of special elements in an SQL command.
The LifterLMS WordPress plugin before 8.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The LifterLMS - WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Unauthenticated Post Trashing due to a missing capability check on the delete_access_plan. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The LifterLMS - WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to arbitrary post deletion due to a missing capability check on the 'llms_delete_cert' action in all. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
The LifterLMS - WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to blind SQL Injection via the 'order' parameter in all versions up to, and including, 7.7.5 due to. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
The LifterLMS - WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to SQL Injection via the orderBy attribute of the lifterlms_favorites shortcode in all versions up to, and. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
Cross-Site Request Forgery (CSRF) vulnerability in LifterLMS.5.0. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The LifterLMS - WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'process_review' function in all. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The LifterLMS - WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 7.4.2 via the maybe_serve_export function. Rated low severity (CVSS 3.3), this vulnerability is remotely exploitable. No vendor patch available.
The LifterLMS PayPal WordPress plugin before 1.4.0 does not sanitise and escape some parameters from the payment confirmation page before outputting them back in the page, leading to a Reflected. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The LMS by LifterLMS - Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4.21.2 was affected by an IDOR issue, allowing students to see other student answers. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The 'State' field of the Edit profile page of the LMS by LifterLMS - Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4.21.1 is not properly sanitised when. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
LifterLMS Wordpress plugin version below 3.37.15 is vulnerable to arbitrary file write leading to remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in the LifterLMS plugin through 3.34.5 for WordPress. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.