CVE-2026-14207: Unknown Lifterlms

Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days.

The LifterLMS WordPress plugin before 10.0.10 does not strip event-handler attributes from a course pricing field before storing and rendering it, allowing users with a course-editing role to inject JavaScript that executes in the session of an administrator who views the course.

Affected products

• Unknown Lifterlms: from 9.2.3, before 10.0.10 (fixed in 10.0.10)

Published 2026-07-30. Last modified 2026-07-30.