vulnerability

WordPress Plugin: lifterlms: CVE-2019-15896: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Severity
7
CVSS
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
Published
Sep 9, 2019
Added
May 15, 2025
Modified
May 15, 2025

Description

An issue was discovered in the LifterLMS plugin through 3.34.5 for WordPress. The upload_import function in the class.llms.admin.import.php script is prone to an unauthenticated options import vulnerability that could lead to privilege escalation (administrator account creation), website redirection, and stored XSS.

Solution

lifterlms-plugin-cve-2019-15896
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.