The LifterLMS WordPress plugin before 10.0.10 does not strip event-handler attributes from a course pricing field before storing and rendering it, allowing users with a course-editing role to inject JavaScript that executes in the session of an administrator who views the course.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Lifterlms Plugin | — | Update lifterlms plugin to version 10.0.10, or a newer patched version | Aug 5, 2026 | Jul 30, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub