CVE-2021-24308: Lifterlms

Medium severity, CVSS 5.4. EPSS: 3.2% chance of exploitation in the next 30 days.

The 'State' field of the Edit profile page of the LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4.21.1 is not properly sanitised when output in the About section of the profile page, leading to a stored Cross-Site Scripting issue. This could allow low privilege users (such as students) to elevate their privilege via an XSS attack when an admin will view their profile.

Affected products

• Lifterlms Lifterlms: before 4.21.1 (fixed in 4.21.1)

Published 2021-05-24. Last modified 2026-06-17.