LifterLMS < 8.0.1 - Cross-Site Scripting

LifterLMS WordPress plugin before 8.0.1 contains a reflected XSS caused by unsanitized and unescaped parameter output, letting attackers execute scripts against high privilege users such as admin via a crafted request. id: CVE-2024-13619 info: name: LifterLMS 8.0.1 - Cross-Site Scripting author:...

CVE-2019-15896

CVE-2019-15896 LifterLMS = 3.34.5 - Unauthenticated Options Import Description Unauthenticated Options Import, which could lead to Website Redirection Administrator Account Creation Content Injection Stored XSS The issues have been reported as fixed in 3.35.0. However v3.35.1 added additional inp...

WordPress LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin <= 10.3.1 - Authenticated (Contributor+) Local File Inclusion vulnerability

Authenticated Contributor+ Local File Inclusion vulnerability discovered by Adrien Brunner in WordPress Plugin LifterLMS versions = 10.3.1...

CVE-2026-110284

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 10.3.1 via attacker-controlled attributes of the lifterlmscheckout shortcode. This is due to the llmsgettemplate helper performing extract o...

EUVD-2026-100904

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 10.3.1 via attacker-controlled attributes of the lifterlmscheckout shortcode. This is due to the llmsgettemplate helper performing extract o...

CVE-2026-110284

The LifterLMS WordPress plugin (versions up to and including 10.3.1 ) is vulnerable to Local File Inclusion (LFI) . The flaw exists in the llms_get_template() helper function, which improperly uses extract() on the [lifterlms_checkout] shortcode attribute array. This allows an authenticated attac...

CVE-2026-110284 LifterLMS <= 10.3.1 - Authenticated (Contributor+) Local File Inclusion via 'lifterlms_checkout' Shortcode Attributes

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 10.3.1 via attacker-controlled attributes of the lifterlmscheckout shortcode. This is due to the llmsgettemplate helper performing extract o...

PT-2026-113721

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 10.3.1 via attacker-controlled attributes of the lifterlms checkout shortcode. This is due to the llms get template helper performing extrac...

CVE-2026-104723

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 10.2.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with custom-level access and above, ...

EUVD-2026-96108

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 10.2.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with custom-level access and above, ...

CVE-2026-104723 LifterLMS <= 10.2.1 - Authenticated (Custom+) PHP Object Injection via 'custom' Lesson Data

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 10.2.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with custom-level access and above, ...

CVE-2026-104723

The LifterLMS WordPress plugin (versions

CVE-2026-104723: Deserialization of Untrusted Data

The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 10.2.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with custom-level access and above, ...

WordPress LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin <= 10.2.1 - Authenticated (Custom+) PHP Object Injection vulnerability

Authenticated Custom+ PHP Object Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin LifterLMS versions = 10.2.1...

CVE-2026-14231

The LifterLMS WordPress plugin before 10.0.10 does not perform a capability check in one of its select2 query AJAX handlers, only verifying that the user is logged in, allowing any authenticated user with subscriber-level access to read the titles of internal post types such as coupon codes by...

CVE-2026-14207

The LifterLMS WordPress plugin before 10.0.10 does not strip event-handler attributes from a course pricing field before storing and rendering it, allowing users with a course-editing role to inject JavaScript that executes in the session of an administrator who views the course...

EUVD-2026-50994

The LifterLMS WordPress plugin before 10.0.10 does not perform a capability check in one of its select2 query AJAX handlers, only verifying that the user is logged in, allowing any authenticated user with subscriber-level access to read the titles of internal post types such as coupon codes by...

WordPress LifterLMS plugin < 10.0.10 - Subscriber+ Sensitive Information Disclosure vulnerability

Subscriber+ Sensitive Information Disclosure vulnerability discovered by Daniel Púa - devploit in WordPress Plugin LifterLMS versions 10.0.10...

CVE-2026-14231 LifterLMS < 10.0.10 - Subscriber+ Sensitive Information Disclosure via select2_query_posts

The LifterLMS WordPress plugin before 10.0.10 does not perform a capability check in one of its select2 query AJAX handlers, only verifying that the user is logged in, allowing any authenticated user with subscriber-level access to read the titles of internal post types such as coupon codes by...

CVE-2026-14231

The LifterLMS WordPress plugin (versions before 10.0.10 ) contains a sensitive information disclosure vulnerability. The root cause is a missing capability check in one of its select2 query AJAX handlers , which only verifies if a user is logged in. This allows any authenticated user with subscri...